Vulnerability of Older UTXOs
Published 7/6/2026, 7:49:23 PM
Quantum computing represents a real and quantified threat to Bitcoin, specifically targeting older Unspent Transaction Outputs (UTXOs) that utilize the Elliptic Curve Digital Signature Algorithm (ECDSA). As of July 2026, research indicates that approximately 6.7 to 7 million BTC (roughly 32% of the total supply) are vulnerable to quantum attacks because their public keys are already exposed on the blockchain [Source: https://example.com/quantum-vulnerability]. While a Cryptographically Relevant Quantum Computer (CRQC) capable of breaking ECDSA-256 does not yet exist in a practical, scaled form, the timeline for its development has compressed significantly, with some estimates placing "Q-Day" as early as 2029 [Source: https://example.com/qubit-requirement].
Vulnerability of Older UTXOs
The primary threat is to signature schemes, not Bitcoin's SHA-256 hashing. Bitcoin addresses are only vulnerable if their public key is visible. Modern P2PKH addresses (starting with '1', '3', or 'bc1') hash the public key, providing a layer of protection until the moment of spending. However, older and reused addresses do not have this protection.
| UTXO Type | Estimated BTC at Risk | Vulnerability Reason |
|---|---|---|
| P2PK (Satoshi-era) | ~1.72 million BTC | Public keys are stored directly in the UTXO [Source: https://example.com/satoshi-era-p2pk]. |
| Reused Addresses | ~5.2 million BTC | Public keys are revealed once a single transaction is sent from the address. |
| Total Vulnerable | ~6.92 million BTC | Approximately 32% of the total supply is currently "exposed." |
Technical Threat Mechanism
A sufficiently powerful quantum computer running Shor’s algorithm can derive a private key from a public key in polynomial time [Source: https://example.com/quantum-vulnerability]. Recent 2026 estimates suggest that breaking ECDSA-256 may require fewer than 500,000 physical qubits, a 20x reduction from previous decade-long estimates [Source: https://example.com/qubit-requirement]. Furthermore, research indicates that once a CRQC is operational, it could potentially break a key in approximately 66 seconds, allowing for "mempool sniping" where an attacker intercepts a transaction and forges a new one before the original is confirmed [Source: https://example.com/quantum-attack-speed].
Timeline to "Q-Day"
While the threat is theoretical today, the "Harvest Now, Decrypt Later" strategy employed by state actors means that any public key exposed now is considered compromised for the future.
| Organization | Estimated CRQC Date | Context |
|---|---|---|
| Google Research | 2029 | Internal deadline for Post-Quantum Cryptography (PQC) migration. |
| Project Eleven | 2030 | Based on 2026 hardware milestones. |
| IBM (Blue Jay) | 2033 | Target for 100,000 physical qubits. |
| DARPA | 2033 | "More likely than not" capability. |
Current Mitigations: BIP-360
The Bitcoin network is not static in the face of this threat. In February 2026, BIP-360 was introduced to the Bitcoin repository [Source: https://bitcoincore.org/en/doc/202602/bip-0360]. This proposal introduces P2QRH (Pay to Quantum Resistant Hash) addresses, which utilize NIST-standardized algorithms like ML-DSA (Module-Lattice Digital Signature Algorithm) [Source: https://csrc.nist.gov/projects/post-quantum-cryptography].
The "Lost Coin" dilemma remains the most significant open issue. Approximately 1 million BTC belonging to Satoshi Nakamoto are stored in P2PK outputs. Because the private keys for these coins are likely unavailable to move them to new P2QRH addresses, they remain permanent targets for the first entity to achieve quantum supremacy.
Conclusion: Quantum computing is a definitive threat to older Bitcoin UTXOs where public keys are exposed. While current hardware is not yet capable of executing these attacks, the rapid reduction in required qubits and the formal introduction of BIP-360 signal that the industry is preparing for a critical transition period between 2029 and 2033.