Can Quantum Computers Break Bitcoin? Coinbase's October 2026 Warning Explained

No quantum computer today can break Bitcoin. But on October 13, 2026, Coinbase — which custodies roughly 5% of all bitcoin in existence — published a proposal arguing the network needs to start migrating to quantum-resistant signatures now, years before any such machine is expected to exist, because the fix itself could take years to roll out. The debate it kicked off is really about timing: when do you start fixing a problem that doesn’t exist yet, so it’s actually fixed by the time it might?

What Coinbase Actually Proposed

Coinbase’s paper, authored by Shashank Agrawal and described by the company as input to an open industry discussion rather than a finished plan, makes one central argument: Bitcoin’s consensus changes and wallet-ecosystem migrations historically take years, so if the network waits until a quantum threat is confirmed to start working on a fix, it will already be too late (CoinDesk; Decrypt).

The proposal doesn’t ask Bitcoin to adopt a single new signature scheme immediately. Instead, Coinbase wants the output format separated from the signature algorithm, so new cryptographic schemes can be swapped in later without another ground-up redesign. It points to two existing proposals as a starting foundation:

• BIP-360 (Pay-to-Merkle-Root, or P2MR): a Taproot-based transaction format that removes Taproot’s key-path spending option — the specific feature that exposes a public key on-chain before a coin is even spent. Multiple outlets reporting on the proposal note that BIP-360 does not, by itself, add quantum-resistant signatures; it’s a structural change that makes adding them later easier. It also remains in draft status, not an adopted standard (KuCoin; crypto.news).
• P2TRv2: a second candidate output format Coinbase names alongside BIP-360 as worth building on.

For the transition period itself, Coinbase proposes hybrid wallets — specifically a 1-of-2 setup where a transaction can be authorized by either a classical ECDSA key or a new post-quantum key, letting holders migrate gradually instead of needing a single flag-day cutover. It also recommends evaluating NIST-selected post-quantum signature standards — ML-DSA, SLH-DSA, and FN-DSA — as they mature, and says at least one post-quantum scheme should be compatible with multi-party computation (MPC) setups used by custodians like Coinbase itself (CoinMarketCap Academy).

How Many Bitcoins Are Actually Exposed?

This is the number everyone cites, and it varies because different researchers measure “exposure” differently. Here’s how the main estimates compare, all describing the situation around early-to-mid October 2026:

Source	Estimated exposed BTC	% of supply	What it counts
Glassnode	~6.26 million BTC	31.2%	Addresses with a public key already visible on-chain, mainly from reused addresses and older script types
Project Eleven	~7.1 million BTC	—	The broadest estimate, including a wider set of exposed-key categories
Coinbase quantum council	Up to 6.9 million BTC	—	Includes roughly 1.7 million BTC in old Satoshi-era P2PK outputs

Glassnode co-founder Rafael Schultze-Kraft detailed the breakdown behind his firm’s figure on October 8, 2026: about 4.33 million BTC of the exposure comes from simple address reuse (spending from an address more than once reveals its public key), and another roughly 1.94 million BTC sits in older transaction structures — including P2PK outputs and Taproot key-path spends — that expose a public key by design (Yahoo Finance / Glassnode).

The reason the numbers don’t match is straightforward: Glassnode counts only keys that are already visible on-chain today, while Project Eleven’s estimate pulls in a broader set of potentially exposed categories. All three sources agree on the general shape of the problem — a meaningful fraction of Bitcoin’s circulating supply, somewhere around 30%, sits in a form that a sufficiently powerful quantum computer could theoretically target, if one ever exists.

Why an Exposed Public Key Actually Matters

Bitcoin addresses don’t show your public key directly — they show a hash of it. A quantum computer running Shor’s algorithm could, in theory, derive a private key from an exposed public key, but it can’t reverse a hash to get the public key in the first place. That’s why address reuse is the practical danger: the first time you spend from a Bitcoin address, your public key becomes visible on the blockchain, even though it was hidden before. If you never spend from that address again, nothing changes. If you reuse it, or if your coins sit in an older format that reveals the key automatically (like raw P2PK, used in the earliest years of Bitcoin, including many Satoshi-era blocks), the key is sitting in public, waiting for a computer that doesn’t exist yet.

Is Bitcoin Mining Also at Risk?

No — and this is the detail most coverage of the quantum debate skips. The threat Coinbase and others describe is specific to Bitcoin’s signature scheme (ECDSA), which secures spending coins. Bitcoin mining relies on SHA-256 hashing through proof-of-work, which a quantum computer could only attack via Grover’s algorithm — a method that offers a quadratic speedup at best, not the exponential break Shor’s algorithm threatens against signatures. Google’s own quantum research team has described a practical Grover’s-algorithm attack on Bitcoin mining as “not a practical concern for decades,” even as the same researchers argue the signature threat deserves earlier attention (The Block).

Where the “2029” Number Actually Comes From

You may see 2029 cited in connection with this story, and it’s worth being precise about what that date actually means. Google set 2029 as an internal target for migrating its own systems to post-quantum cryptography, announced by Google security leads Heather Adkins and Sophie Schmieg — it is not a prediction that a quantum computer capable of breaking Bitcoin will exist by then (Decrypt). Separately, Google Research published updated estimates suggesting the computational resources needed to break cryptography of this kind have dropped roughly twentyfold compared to earlier projections — which is the finding that pushed Coinbase and others to treat the planning timeline as more urgent, even while describing an actual capable machine as still several years away at minimum.

What Coinbase’s Proposal Does and Doesn’t Change Today

Nothing has been adopted. BIP-360 remains a draft proposal, not an approved upgrade to Bitcoin’s consensus rules, and no mandatory migration deadline has been set for anyone. Coinbase has framed its paper explicitly as a contribution to an ongoing technical discussion among Bitcoin developers, not a final roadmap the network is committed to. Any actual change to Bitcoin’s signature scheme would need to go through the same slow, consensus-driven process — proposal, developer review, client implementation, and broad adoption — that every past Bitcoin soft fork has required.

One open question Coinbase explicitly declines to answer: what happens to dormant, lost, or Satoshi-era coins that never migrate to a new signature format? Those coins would, in theory, remain in exposed legacy addresses indefinitely. Coinbase treats that as a separate governance and policy problem from the technical migration work — deciding whether, or how, to eventually restrict spending from unmigrated legacy outputs is a far more contentious question than building the cryptography itself, and one the Bitcoin community hasn’t begun to resolve.

What This Actually Means for You

If you hold Bitcoin, there is no action required today — no fund is at risk, no deadline exists, and no quantum computer capable of this attack has been built. The one habit worth adopting regardless of how this debate resolves: avoid reusing Bitcoin addresses, since that’s the single largest source of exposed public keys according to Glassnode’s own data, and it’s a habit modern wallet software already defaults away from for most users. Beyond that, this is a story worth tracking over months and years, not one that calls for moving funds this week. If you want to understand hardware-level risks to your coins in the meantime, the Ledger CryptoBilis hardware wallet implant breach from earlier this month is a useful reminder that supply-chain and protocol-level risks are different categories worth understanding separately — much like the XRP Ledger’s decade-old overflow bug showed how even long-settled protocol code can carry risks nobody had flagged until someone looked for them.

This isn’t financial advice, and nothing here should be read as a prediction of when or whether Bitcoin’s cryptography will actually be broken. Treat the quantum computing debate the way the Bitcoin development community currently does: a real, long-term engineering question worth solving early, not an emergency.