Bitcoin just crossed an uncomfortable threshold. According to a 2026 on-chain analysis from Glassnode, 6.04 million BTC, or 30.2% of the entire issued supply, now sits in addresses where the public key is already visible on the blockchain. At current prices that stash is worth roughly $469 billion, and it is the exact category of funds a working quantum computer would go after first. None of that money is under active attack today. But the standards bodies racing to get ahead of the problem just hit a milestone that made the risk a lot more concrete than it was a year ago.
On July 20, 2026, the National Institute of Standards and Technology confirmed its post-quantum cryptography baseline, FIPS 203, FIPS 204 and FIPS 205, had moved from draft status to final, published federal standards, carrying the same legal weight as AES and SHA-2. That single administrative fact reshapes the conversation around Bitcoin’s long-term security model, because it means the tools to defend against a quantum attacker now exist in finished, implementable form. What doesn’t exist yet is a plan for actually deploying them across a $1.9 trillion asset that was never designed to swap out its signature scheme.
What Actually Happened: NIST Finalizes Its Post-Quantum Baseline
NIST’s post-quantum cryptography program has been running since 2016, but 2026 is the year the paperwork caught up with the math. FIPS 203 (ML-KEM, for key establishment), FIPS 204 (ML-DSA, for digital signatures) and FIPS 205 (SLH-DSA, a hash-based signature scheme) are now treated as the stable, final baseline, according to a July 20, 2026 status update tracked by NIST’s Computer Security Resource Center. Products can ship today claiming compliance with these standards the same way they’d claim AES-256 or SHA-2 support.
NIST isn’t waiting around for a fault-tolerant quantum machine to show up before pushing adoption. The agency’s own messaging, summarized on its public post-quantum cryptography page, states plainly that these standards are ready for implementation now and are meant to protect everything from email to e-commerce well before large-scale quantum hardware exists. That urgency isn’t cosmetic. Data encrypted today with vulnerable algorithms can be captured and stored by an adversary, then decrypted later once a capable quantum computer comes online, a pattern researchers call store-now-decrypt-later. For financial infrastructure with decades-long time horizons, that clock is already running.
The standardization pipeline isn’t done, either. On May 14, 2026, NIST advanced nine additional signature candidates, including FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign and UOV, into a third evaluation round documented in NIST IR 8610. One of those, HAWK, was later withdrawn by its own development team, a reminder that post-quantum cryptography is still an active research field, not a solved problem with a single correct answer. NIST also finalized crypto-agility guidance, CSWP 39, on June 29, 2026, aimed specifically at systems, blockchains among them, that need to support multiple algorithms and migrate between them without a full redesign.
The $469 Billion Question: How Much Bitcoin Is Actually Exposed
Bitcoin’s cryptography has two layers of protection built in, and most coin holders benefit from both without ever thinking about it. A standard address is a hash of a public key, not the public key itself, so as long as funds sit untouched in a fresh address, an attacker only sees a hash, which current cryptanalysis (quantum or classical) cannot reverse. The problem is that the underlying public key gets revealed the moment a transaction is broadcast to spend from that address. From that point forward, anyone, including a future quantum adversary, can see the exposed key sitting on the public ledger forever.
That’s how you get to 6.04 million exposed BTC. Glassnode’s 2026 breakdown, cited in a research note from Spark’s post-quantum cryptography team, splits that figure into two distinct risk categories. About 1.92 million BTC sits in legacy pay-to-public-key (P2PK) outputs, an early Bitcoin script format that puts the raw public key on-chain permanently, with no hash layer protecting it at all. The remaining 4.12 million BTC comes from address reuse across P2PKH, P2SH and P2WPKH formats, where a wallet owner has spent from the same address more than once, exposing the public key even though the address format itself was designed to hide it.
The distinction matters because it determines what can actually be fixed before quantum hardware becomes dangerous. The 1.92 million BTC in P2PK outputs is largely early-era coin, some of it presumed lost or belonging to wallets whose owners are inactive or deceased, meaning nobody can move it to a safer format even if they wanted to. The 4.12 million BTC in reused addresses is different: if the owner still holds the private key, they can migrate those funds to a fresh, unused address today and remove the exposure entirely. That single piece of wallet hygiene, never reuse a Bitcoin address, has quietly become one of the more effective quantum defenses available right now, years before any migration standard ships.
| Exposure Category | BTC Affected | Approx. Value (2026) | Root Cause | Can Be Fixed Today? |
|---|---|---|---|---|
| Structural (P2PK) | 1.92 million | ~$149 billion | Legacy script exposes raw public key permanently | No, requires holder action that’s often unavailable |
| Operational (address reuse) | 4.12 million | ~$320 billion | Repeated spending from same address reveals key | Yes, migrate to a fresh address |
| Total exposed supply | 6.04 million | ~$469 billion | Combined | Partially |
| Unexposed supply | ~13.9 million | ~$1.08 trillion | Public key never revealed on-chain | Not applicable |
It’s worth being precise about what this table does and doesn’t say. No quantum computer built in 2026 can derive a private key from an exposed public key using Shor’s algorithm against Bitcoin’s secp256k1 elliptic curve. Every credible assessment of current quantum hardware, including commentary tied to NIST’s own PQC program, places that capability well beyond today’s pre-fault-tolerant machines. The $469 billion figure isn’t a balance at risk this year. It’s a map of where the damage would concentrate the day that capability arrives, which is exactly why researchers are pushing wallet hygiene and protocol-level planning now instead of waiting for a hardware breakthrough to force the issue.
Why Nobody Is Panicking Yet: The Hardware Gap
The gap between “NIST finalized post-quantum standards” and “your Bitcoin is in danger” is enormous, and it’s worth walking through why. Breaking secp256k1 elliptic curve cryptography, the scheme underpinning every Bitcoin signature, requires a fault-tolerant quantum computer running Shor’s algorithm at a scale nobody has built. Estimates for the number of stable, error-corrected logical qubits needed for that kind of attack run into the millions of physical qubits once error correction overhead is factored in. Current quantum processors from IBM, Google and other labs are still measured in the hundreds of physical qubits, and they remain firmly in the pre-fault-tolerant era, meaning error rates are still too high to run long, complex algorithms like Shor’s reliably.
That gap is precisely why the standards conversation is happening now rather than being deferred. Migrating a system as large and decentralized as Bitcoin doesn’t happen overnight. It requires new address formats, wallet software updates, exchange and custodian coordination, and years of parallel operation before anyone can safely deprecate the old scheme. NIST’s own crypto-agility guidance, finalized in June 2026, exists specifically because agencies and infrastructure operators learned from prior cryptographic transitions, like the multi-decade move away from SHA-1, that waiting until a threat is imminent guarantees a rushed, error-prone migration. Bitcoin’s situation is arguably harder than a typical enterprise system because there’s no central authority that can mandate an upgrade; every wallet, exchange and node operator has to opt in through consensus.
Markets have, so far, priced this as exactly what it is: a long-horizon tail risk rather than a near-term catalyst. There’s no evidence of panic selling or even meaningful price correlation tied to quantum computing headlines through August 2026. That’s arguably rational given the hardware timeline, but it also means the incentive to fund and prioritize a Bitcoin-specific post-quantum migration remains weaker than the technical urgency would suggest. Nobody moves fast on a problem the market isn’t pricing.
How Bitcoin Would Actually Migrate
Unlike a company rotating a TLS certificate, Bitcoin can’t just swap its signature algorithm and push an update. Any change to how transactions are signed and verified touches consensus rules, meaning every full node in the network has to agree on the new rules or the chain risks splitting. The migration path researchers are converging on avoids a wholesale replacement of secp256k1 across the entire unspent transaction output set. Instead, the more realistic route runs through new script templates and address types, similar in spirit to how SegWit and Taproot were introduced as opt-in upgrades layered on top of the existing protocol rather than forced rewrites of it.
In practice that likely means a future soft fork introduces a new output type that verifies against a post-quantum signature scheme, users voluntarily move funds into addresses using that format, and the old ECDSA-based addresses remain valid but increasingly discouraged for new deposits over a multi-year transition window. That’s a slower, messier process than a coordinated protocol flag day, but it matches how Bitcoin has handled every major cryptographic and scripting change since its 2009 launch. No concrete BIP number has emerged yet specifically proposing a post-quantum signature scheme for mainnet deployment, and any serious proposal would need to pick a winner from NIST’s finalized or soon-to-be-finalized signature algorithms, most likely ML-DSA or SLH-DSA given their standardized status.
The practical challenge is signature size. ML-DSA and SLH-DSA signatures run considerably larger than the compact ECDSA signatures Bitcoin uses today, which has direct implications for block space, transaction fees and node storage at Bitcoin’s scale. Any migration proposal has to grapple with that tradeoff, and it’s a big part of why NIST’s third-round evaluation of additional signature candidates, including smaller schemes like SQIsign, matters for blockchain applications specifically. A signature scheme that’s secure but doubles average transaction size isn’t a free upgrade for a network already sensitive to fee pressure.
Ethereum’s Head Start: Application-Layer Post-Quantum Signatures
Ethereum’s account model gives it a meaningfully easier path to quantum resistance than Bitcoin’s UTXO structure, and 2026 is the year that advantage started showing results. The Pectra upgrade, deployed across 2025 and 2026 and including EIP-7702, matured Ethereum’s account abstraction infrastructure to the point where ERC-4337 smart contract wallets can now, in principle, verify alternative signature schemes at the contract level instead of requiring a base-protocol change. According to a roadmap discussion published on Ethereum’s official site, the first production ERC-4337 wallets using post-quantum signatures were live by 2026, though adoption remains limited to a niche set of security-conscious users rather than the default experience.
The leading candidate discussed in Ethereum’s 2026 roadmap materials is Falcon, a lattice-based signature scheme that NIST is tracking under a draft standard, FIPS 206 (FN-DSA), though that standard remained in draft form as of mid-2026 with final publication expected in late 2026 or 2027. The strategic logic is straightforward: rather than waiting for a consensus-layer overhaul, Ethereum lets its smart contract wallet ecosystem experiment with post-quantum signatures now, building operational experience and tooling before any base-protocol migration becomes urgent. That’s a meaningfully different bet than Bitcoin’s more conservative, consensus-cautious posture, and it means Ethereum’s post-quantum readiness, at least at the application layer, currently has a multi-year head start.
| Metric | Bitcoin | Ethereum |
|---|---|---|
| Current signature scheme | ECDSA (secp256k1) | ECDSA (secp256k1), transitioning |
| Post-quantum signatures live today | No | Yes, via ERC-4337 smart wallets (niche adoption) |
| Migration architecture | New opt-in script/address types via soft fork | Application-layer via account abstraction (EIP-7702) |
| Leading PQC candidate discussed | ML-DSA / SLH-DSA (NIST-finalized) | Falcon / FN-DSA (NIST draft, FIPS 206) |
| Estimated exposed value | ~$469 billion (6.04M BTC) | Not yet quantified at comparable scale |
| Consensus-layer PQC change shipped | No | No (application-layer only so far) |
Historical Context: This Isn’t Bitcoin’s First Cryptographic Scare
Bitcoin has weathered cryptographic anxiety before without a catastrophic failure, and that track record is part of why the market isn’t reacting sharply to the quantum headlines. SHA-256, the hash function underlying Bitcoin’s mining and address derivation, has been the subject of periodic collision-resistance research for over a decade with no practical break ever demonstrated. The broader industry’s move away from SHA-1 after real collision attacks were published in 2017 offers a useful precedent: that migration took years of advance warning, staged deprecation and eventual retirement, not a sudden, forced cutover. NIST’s own crypto-agility guidance explicitly references this kind of gradual, multi-algorithm transition as the model to follow.
What’s different this time is the scale of what’s exposed and the fact that, unlike SHA-1, the eventual attack capability doesn’t yet exist anywhere. That’s simultaneously reassuring, there’s no active exploit to patch against, and concerning, because it means the industry has to build institutional urgency around a threat with no visible victims yet. Historically, security-critical migrations without an active incident tend to move slowly. Bitcoin’s own SegWit and Taproot upgrades, both non-emergency improvements, took years between proposal and majority adoption. A post-quantum migration, without a forcing event, could easily follow the same multi-year arc, which is exactly the scenario researchers are trying to get ahead of by raising the exposure numbers now.
What Custodians and Exchanges Are Actually Doing
For large holders, the practical response to quantum exposure isn’t waiting for a protocol upgrade, it’s basic operational hygiene applied at scale. The clearest, most immediately actionable step identified in 2026 research is address rotation: never spend from the same address twice, and treat any address that has already broadcast a transaction as permanently public-key-exposed going forward. Custodians managing large cold storage reserves are the natural first movers here, since they control enough of the exposed 4.12 million BTC in reused addresses to meaningfully shrink the at-risk total simply by adopting stricter address management policies.
The harder problem is the 1.92 million BTC sitting in P2PK outputs, much of it early-era coin where addresses reveal a raw public key permanently by design, regardless of spending behavior. A meaningful share of that supply is presumed dormant, tied to early miners, lost wallets or inactive holders who may never move it. That coin represents a hard floor of exposure that no amount of best-practice wallet hygiene can eliminate before a protocol-level fix exists, and it’s the segment most likely to be the actual first target if quantum capability ever does arrive, simply because there’s no owner around to migrate it defensively.
Market Impact: A Tail Risk the Market Hasn’t Priced
Through August 2026, Bitcoin’s price action shows no discernible correlation with post-quantum cryptography headlines, including the NIST standards finalization in July. That’s consistent with how markets tend to treat multi-year, hardware-gated risks: they get filed under long-term due diligence rather than immediate trading signals. The more interesting market effect is happening one layer down, in the infrastructure and services space building around post-quantum readiness. Wallet vendors, custody providers and blockchain security firms have started marketing quantum-resistant features and audits as a differentiator, effectively turning a still-theoretical threat into a present-day competitive angle.
That dynamic mirrors what happened in traditional enterprise security once NIST’s PQC standards started finalizing: vendors that could credibly claim FIPS 203/204/205 compliance moved faster to market it than the underlying threat timeline strictly justified, because compliance itself has commercial value independent of imminent risk. Expect the same pattern to intensify in crypto custody and wallet software through the rest of 2026 and into 2027, with “quantum-resistant” becoming a checkbox feature in institutional custody RFPs well before any Bitcoin protocol change actually ships.
Competitive Landscape: Who’s Actually Ready
Ranking blockchain post-quantum readiness in 2026 comes down less to marketing claims and more to architectural flexibility. Ethereum’s account abstraction work gives it a genuine structural advantage: it can experiment with post-quantum signatures at the wallet layer without touching consensus, which is a much lower-friction path than anything available to Bitcoin today. Bitcoin’s advantage runs the other direction, its conservative, slow-moving governance model has historically avoided the kind of rushed protocol changes that introduce new bugs, which matters enormously for a network securing over a trillion dollars in value. Slower isn’t necessarily worse here; it’s a different risk tradeoff.
Newer layer-1 chains launched with more modern cryptographic tooling have an easier time in theory, since they can bake in crypto-agility from genesis rather than retrofitting it. But none of them carry anywhere near Bitcoin or Ethereum’s exposed value, so the stakes of getting a migration wrong, or of not migrating at all before a real threat emerges, are lower across the board. The chains actually worth watching for concrete post-quantum shipping milestones over the next 12 to 18 months are the ones with the most exposed legacy value to protect, which keeps the spotlight squarely on Bitcoin and Ethereum.
Predictions: Where This Goes Next
- NIST will finalize FIPS 206 (Falcon/FN-DSA) in late 2026 or early 2027, giving Ethereum’s application-layer post-quantum wallets a fully standardized signature scheme to build against rather than a draft.
- Expect the first concrete Bitcoin Improvement Proposal explicitly targeting a post-quantum address type within the next 12 to 24 months, most likely built around ML-DSA or SLH-DSA given their finalized NIST status, though mainnet activation will take years beyond that.
- Custody providers and exchanges holding large reserves will increasingly publish address-reuse audits and rotation policies as a trust signal, turning quantum hygiene into a visible compliance and marketing feature well before it’s operationally urgent.
- Quantum-resistant wallet features will proliferate faster than the underlying threat justifies, following the same pattern seen in enterprise software once NIST’s core standards went final, because compliance claims carry commercial value independent of actual risk timing.
- No verifiable quantum attack on live Bitcoin or Ethereum funds will occur before 2030, based on the current gap between fault-tolerant quantum hardware requirements and 2026-era quantum processors, though the exposed-value headline figure will keep climbing as more legacy addresses get analyzed.
What Bitcoin Holders Should Actually Do Right Now
None of this requires panic, but it does justify a checklist. First, stop reusing addresses entirely, every modern wallet supports generating a fresh receiving address per transaction, and doing so removes the single largest controllable slice of quantum exposure. Second, if you’re holding coin in an old P2PK-era wallet or an address you know has been reused repeatedly, consider consolidating those funds into a fresh, never-used address now, while the operation is purely precautionary rather than a race against an active threat. Third, keep an eye on wallet software updates over the next few years; when post-quantum address formats do ship, early, voluntary migration will be far less chaotic than a rushed move once a credible quantum threat timeline becomes public.
Fourth, treat quantum-resistant marketing claims from custodians and wallet vendors with the same scrutiny you’d apply to any new security feature: ask specifically which NIST-finalized algorithm they’re using, ML-DSA, SLH-DSA or another, and whether the claim covers wallet-layer signing, cold storage key generation, or both. A lot of the current messaging is directionally accurate but ahead of what’s actually been built and audited. The underlying math isn’t in question. What’s still being worked out is how a fifteen-year-old, famously conservative protocol coordinates a cryptographic transition without a central authority to force the timeline.
Frequently Asked Questions
Is Bitcoin vulnerable to quantum computers right now, in 2026?
No. Breaking Bitcoin’s ECDSA signatures requires a fault-tolerant quantum computer running Shor’s algorithm at a scale far beyond any machine built as of 2026. Current quantum processors remain in the pre-fault-tolerant era, with error rates too high to execute that kind of attack. The 6.04 million BTC figure describes what’s exposed once that hardware exists, not funds at risk today.
What does it mean for a Bitcoin address to have an exposed public key?
A standard Bitcoin address is a hash of a public key, which hides the actual key until funds are spent from it. Once you broadcast a transaction, the public key becomes visible on the blockchain permanently. Addresses that have never been spent from keep their public key hidden; addresses that have been reused reveal it.
How do I know if my own Bitcoin is exposed?
Check whether any address you’ve held funds in has ever sent a transaction. If it has, its public key is exposed on-chain. The fix is to move remaining funds to a brand-new address that has never been used, and to avoid reusing addresses going forward.
What are FIPS 203, 204 and 205?
They’re NIST’s finalized post-quantum cryptography standards as of July 20, 2026: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) for hash-based signatures. They carry the same federal standards status as AES and SHA-2 and can be implemented in production systems today.
Has Bitcoin proposed a specific post-quantum upgrade yet?
Not a finalized one. Researchers and developers have discussed adding new, opt-in address types built on NIST-finalized algorithms like ML-DSA or SLH-DSA, deployed through a soft fork similar to how SegWit and Taproot were introduced. No concrete Bitcoin Improvement Proposal has reached mainnet activation as of August 2026.
Is Ethereum ahead of Bitcoin on quantum resistance?
At the application layer, yes. Ethereum’s account abstraction upgrades, including EIP-7702, let ERC-4337 smart contract wallets adopt post-quantum signature schemes like Falcon without changing base-protocol consensus rules. Adoption is still niche, and Ethereum’s core consensus layer hasn’t migrated either, but the architecture gives it more flexibility to experiment.
Should I move my Bitcoin to a different wallet because of quantum risk?
Not urgently, but address hygiene matters. Using a wallet that generates a fresh address for every transaction and never reuses one already removes the largest controllable category of exposure. There’s no need to switch to an exotic quantum-proof product in 2026; the bigger win is simply not reusing addresses.
When will quantum computers actually be able to break Bitcoin’s encryption?
Nobody has a confirmed date. Current hardware trajectories from major quantum computing labs remain well short of the millions of error-corrected logical qubits generally estimated as necessary to break secp256k1 with Shor’s algorithm. Most researchers frame this as a multi-decade hardware problem paired with a near-term migration-planning problem, not an imminent event.
