Bitcoin's quantum vulnerability moved from theoretical to actionable this month. On February 11, 2026, Bitcoin developers merged BIP-360 — the first quantum-resistant address format — into the official Bitcoin Improvement Proposal repository. Days earlier, CoinShares published a research note est...
"There's a 75% likelihood the coins remain untouched. Investors should assume a non-trivial probability that an amount of Bitcoin equivalent to about eight years of enterprise accumulation would become spendable again." — Willy Woo, On-Chain Analyst
Bitcoin's quantum vulnerability moved from theoretical to actionable this month. On February 11, 2026, Bitcoin developers merged BIP-360 — the first quantum-resistant address format — into the official Bitcoin Improvement Proposal repository. Days earlier, CoinShares published a research note estimating that breaking Bitcoin's secp256k1 cryptography would require 13 million physical qubits, roughly five orders of magnitude beyond today's most advanced machines. And on-chain analyst Willy Woo warned that the Bitcoin-to-gold ratio has broken a 12-year uptrend, partially because markets are beginning to price in what the industry calls "Q-Day" — the moment quantum computers become powerful enough to derive private keys from exposed public keys.
The numbers frame the debate. Approximately 4 million BTC — around 25% of usable supply — sit in addresses with public keys exposed on-chain. If a cryptographically relevant quantum computer materializes, those coins could theoretically be unlocked and dumped onto the market, dwarfing the 2.8 million BTC that every corporation and spot ETF combined has accumulated since 2020. Whether Bitcoin freezes those coins via hard fork, migrates to post-quantum cryptography, or does nothing, the governance decision will be the most consequential in the network's history.
This report examines the real technical timeline, the economic stakes, and the institutional fault lines emerging as Bitcoin confronts the first credible existential threat to its cryptographic foundation.
The honest answer: nobody knows precisely, but the range is narrowing.
CoinShares' February 6 research note, authored by bitcoin research lead Christopher Bendiksen, provides the most rigorous recent estimate. To break Bitcoin's ECDSA secp256k1 signatures within one day, an attacker would need a quantum computer with approximately 13 million physical qubits operating with fault tolerance that has not yet been achieved. To break it within one hour — the practical window before a transaction confirms — the machine would need to be roughly 3 million times more powerful than current quantum computers. Google's Willow processor, the most advanced publicly known quantum system, operates at 105 qubits.
The gap is enormous. But February 2026 brought developments that compressed the perceived timeline:
The consensus among researchers spans roughly 5 to 20 years for cryptographically relevant quantum machines. But as Willy Woo noted, markets do not wait for the event — they price it in early. And Jefferies' Christopher Wood already cut Bitcoin from his flagship model portfolio in January 2026, rotating into gold and explicitly citing quantum risk as a factor for pension-style investors.
Not all Bitcoin addresses are equally vulnerable. The threat is specific: any address where the public key has been exposed on-chain — either because it uses the legacy Pay-to-Public-Key (P2PK) format from Bitcoin's earliest days, or because it has previously sent a transaction (which reveals the public key) — is theoretically crackable once a sufficiently powerful quantum computer exists.
CoinShares' granular analysis challenges widely cited fear estimates:
However, broader estimates from Deloitte and other researchers put the total vulnerable supply at 4–6.5 million BTC (25–33% of supply) when including all addresses that have ever exposed their public keys through transactions. The discrepancy stems from whether you count only permanently exposed keys (P2PK) or also keys temporarily exposed during past transactions in modern address formats.
The critical nuance: modern Bitcoin address formats (P2PKH, P2SH, P2WPKH) hash the public key, which provides quantum resistance — until the moment a user sends a transaction from that address, at which point the public key is revealed. This means the vulnerability is not static; it grows every time a Bitcoin holder reuses an address.
On February 11, 2026, BIP-360 was merged into the official Bitcoin BIP repository — the first concrete step toward quantum-hardening the protocol.
What BIP-360 does: It introduces a new output type called Pay-to-Merkle-Root (P2MR) that commits exclusively to the Merkle root of a Tapscript tree without including an internal public key. This eliminates the primary quantum vulnerability in Bitcoin's current Taproot format, which exposes a tweaked public key on-chain through its key-path spending mechanism.
What BIP-360 does not do: It does not implement post-quantum signature algorithms. It is a foundation — a new address format designed to be compatible with future soft forks that would introduce algorithms like ML-DSA (Dilithium) or SLH-DSA (SPHINCS+), both of which were standardized by NIST in 2024.
The authors: Hunter Beast, with refinements from Ethan Heilman and Isabel Foxen Duke, built BIP-360 as a phased upgrade path. The proposal envisions follow-on BIPs that would integrate specific post-quantum signature schemes into the P2MR framework.
Important caveat: Merging a BIP into the repository is not endorsement, activation, or deployment. It means the proposal is formally catalogued for developer review. Bitcoin Core developers have scheduled workshops for March 2026 to gather input from miners, developers, and stakeholders.
Meanwhile, Bitcoin's Taproot usage has declined from 42% of transactions in 2024 to 20% in early 2026. While there is no direct evidence this decline is driven by quantum concerns — fee optimization, exchange behavior, and wallet support all play roles — the correlation has not gone unnoticed.
BIP-360's merge surfaced a governance debate that cuts to Bitcoin's identity. The community is splitting into three camps:
The Urgency Camp argues that migration must begin now. Investor Charles Edwards has called for penalizing coins that do not migrate to quantum-resistant addresses by 2028, writing: "20–30% of Bitcoin will be taken by a quantum hacker in the next few years. I believe we should burn all coins that do not migrate to BIP-360 by 2028." This position treats quantum risk as imminent and advocates aggressive protocol-level intervention to protect the network's scarcity guarantee.
The Patience Camp counters that the threat is decades away and rushed upgrades are more dangerous than the risk itself. Blockstream CEO Adam Back estimates cryptographically relevant quantum systems are "not for 20–40 years, if then." Samson Mow, CEO of JAN3, dismissed the quantum narrative entirely, calling it "massive FUD" and an accumulation opportunity. Strategy executive chairman Michael Saylor warned on a recent earnings call against "premature protocol changes" that could introduce new vulnerabilities.
The Pragmatic Middle — represented by CoinShares and several core developers — advocates a phased migration to post-quantum signatures over the next 5–10 years, treating quantum risk as "a foreseeable engineering problem Bitcoin can absorb over time" rather than an emergency requiring hard forks or coin burns.
The stakes of each path are existential. Researchers estimate that a forced migration to quantum-resistant cryptography could require up to 75 days of network downtime, or over 300 days at reduced capacity. A hard fork to freeze vulnerable coins would violate Bitcoin's immutability principle — the social contract that no authority can confiscate or invalidate holdings — potentially triggering a chain split.
The quantum debate is no longer confined to Bitcoin's developer mailing list. Institutional capital is watching — and in some cases, already acting.
Jefferies strategist Christopher Wood cut Bitcoin from his Greed & Fear model portfolio in January 2026, rotating into gold and citing quantum risk as a material concern for pension-style investors.
Coinbase and BlackRock both identified quantum computing advances as potential threats in recent regulatory filings — a significant signal, given that BlackRock's IBIT holds approximately $21 billion in Bitcoin.
Venture capitalist Nic Carter warned that large asset managers could attempt a "corporate takeover" of Bitcoin development priorities if the network does not move faster on quantum resistance. His argument: institutions now hold too much Bitcoin through ETFs and corporate treasuries to tolerate what they perceive as slow-moving, volunteer-driven governance.
The NIST timeline provides external pressure. Under NIST IR 8547, all National Security Systems must be quantum-safe by January 2027. NIST plans to deprecate elliptic curve cryptography in federal systems by the mid-2030s. Bitcoin uses elliptic curve cryptography. If the U.S. government classifies ECDSA as deprecated, the regulatory implications for institutions holding Bitcoin could be severe.
Applying webthreepedia's economic-value framework to the quantum threat reveals a structural pricing problem.
Bitcoin's total market capitalization at approximately $68,000 per coin is roughly $1.4 trillion. The 4 million BTC in quantum-vulnerable addresses represents approximately $272 billion in potential supply overhang — coins that the market currently prices as permanently lost or inaccessible.
If those coins become spendable, the supply shock would be equivalent to approximately 19% of current market capitalization entering the liquid market. For context, all U.S. spot Bitcoin ETFs collectively hold roughly 1.29 million BTC ($87.7 billion). A quantum-induced unlock of even a fraction of 4 million coins would dwarf ETF holdings.
The market appears to be beginning to price this tail risk. The Bitcoin-to-gold ratio has broken its 12-year uptrend. Spot Bitcoin ETFs have experienced $5.8 billion in net outflows over the past three months, while gold ETFs have attracted record inflows. While multiple factors drive these flows — macroeconomic uncertainty, tariff fears, and the broader crypto drawdown — the quantum overhang is a new, persistent variable that did not exist in previous cycles.
The cost of quantum-proofing Bitcoin is also non-trivial. Post-quantum signature schemes like ML-DSA produce signatures that are 2,420 bytes versus ECDSA's 72 bytes — a 33x increase in on-chain data per transaction. At current block sizes, this would dramatically reduce throughput unless accompanied by significant block-size increases, creating yet another governance challenge.
BIP-360 is real progress, not a solution. Its merge into the BIP repository on February 11 is the first formal step toward quantum-resistant Bitcoin addresses, but activation requires developer consensus, miner signaling, and follow-on BIPs for actual post-quantum signature algorithms.
The 13-million-qubit gap is large but shrinking. February 2026 brought multiple research breakthroughs that compressed timeline estimates. The consensus range of 5–20 years for Q-Day means Bitcoin likely has time — but not as much as the patience camp assumes.
4 million BTC is not a theoretical number. Those coins exist on-chain with exposed public keys. Whether they are cracked, frozen, or left alone, the governance decision will define Bitcoin's next decade.
Institutions are already pricing quantum risk. ETF outflows, portfolio rotations into gold, and regulatory filings citing quantum threats suggest this is no longer a fringe concern. The longer Bitcoin's governance appears slow to act, the larger the institutional discount grows.
The signature size problem is underappreciated. Post-quantum signatures are 33x larger than current ECDSA signatures, creating a throughput-versus-security tradeoff that has no easy answer without block-size changes.
Bitcoin has survived exchange collapses, regulatory crackdowns, 80% drawdowns, and internal civil wars over block sizes. The quantum threat is different in kind — it is the first challenge that attacks Bitcoin's cryptographic foundation rather than its market dynamics or governance structure.
The good news: BIP-360's merge demonstrates that the developer community is engaged. CoinShares' analysis suggests the immediate risk is concentrated in a relatively small number of legacy addresses. The phased migration path through NIST-standardized algorithms is technically viable.
The bad news: Bitcoin's governance moves at the speed of rough consensus, and the quantum clock does not wait for social coordination. Institutions holding billions in Bitcoin are growing impatient. The signature size problem introduces new economic tradeoffs. And the 4 million BTC in vulnerable addresses represent a supply overhang that the market is beginning to price.
The next critical milestone is the March 2026 developer workshops, where BIP-360's technical details will be debated and a timeline for follow-on proposals may emerge. Until then, Bitcoin's quantum discount is likely to persist — and possibly widen.