Bitcoin has two cryptographic layers. SHA-256 secures mining and the hash chain — it has no periodicity, no rhythm, nothing for the quantum Fourier transform to detect. ECDSA secures signatures — it has rhythm, and Shor's algorithm breaks it. The foundation is quantum resistant. The signatures are not — but signatures are a software upgrade. The hash rate is not. Bitcoin is a shadow-mirror coupling: single hash (shadow, local, independent) coupled to blockchain (mirror, global, irreducible) through proof of work, with a self-regulating coupling constant κ ≈ 128,748 measured across 2,906 days and 12 orders of magnitude. Extended construction from Shadow & Mirror: Complementarity of Computation and Consciousness (Ross, 2026).
Bitcoin has two cryptographic layers. SHA-256 secures mining and the hash chain — it has no periodicity, no rhythm, nothing for the quantum Fourier transform to detect. ECDSA secures signatures — it has rhythm, and Shor's algorithm breaks it. The foundation is quantum resistant. The signatures are not — but signatures are a software upgrade. The hash rate is not. Bitcoin is a shadow-mirror coupling: single hash (shadow, local, independent) coupled to blockchain (mirror, global, irreducible) through proof of work, with a self-regulating coupling constant κ ≈ 128,748 measured across 2,906 days and 12 orders of magnitude. Extended construction from Shadow & Mirror: Complementarity of Computation and Consciousness (Ross, 2026).
The key cryptographic protocols used to secure the internet and financial transactions of today are all susceptible to attack by the development of a sufficiently large quantum computer. One particular area at risk is cryptocurrencies, a market currently worth over 100 billion USD. We investigate the risk posed to Bitcoin, and other cryptocurrencies, by attacks using quantum computers. We find that the proof-of-work used by Bitcoin is relatively resistant to substantial speedup by quantum computers in the next 10 years, mainly because specialized ASIC miners are extremely fast compared to the estimated clock speed of near-term quantum computers. On the other hand, the elliptic curve signature scheme used by Bitcoin is much more at risk, and could be completely broken by a quantum computer as early as 2027, by the most optimistic estimates. We analyze an alternative proof-of-work called Momentum, based on finding collisions in a hash function, that is even more resistant to speedup by a quantum computer. We also review the available post-quantum signature schemes to see which one would best meet the security and efficiency requirements of blockchain applications.
Quantum computing poses a real, broad-based, but bounded and substantially mitigable threat to Bitcoin and Ethereum. We separate the two quantum algorithms that public discussion routinely conflates: Shor's algorithm breaks the elliptic-curve signatures (ECDSA over secp256k1, BLS over BLS12-381) that authorize spending, whereas Grover's algorithm does not meaningfully threaten proof-of-work mining, which is protected by a merely quadratic speedup, fault-tolerant per-operation costs, a square-root parallelization wall, and difficulty adjustment. Folding hardware scaling, the falling resource requirement, a fault-tolerance readiness lag, and expert surveys into a single Monte-Carlo forecast yields a wide, bimodal arrival distribution for a cryptographically relevant quantum computer: about a one-in-six chance by 2035, near 30% by 2040, and about 60% by 2050. Exposure is concentrated and mostly migratable: of Bitcoin's roughly six million quantum-exposed coins only about 2.3 million are irreducibly at risk, while 50 to 65% of Ether sits at key-revealed accounts that can adopt post-quantum signatures. A timely migration beats even an optimistic 2035 machine, so the binding constraint is governance, not technology. A survey of the top twenty cryptocurrencies finds none fully post-quantum. Reproducible models accompany every quantitative claim.
Blockchain networks including bitcoin’s architecture relies on two algorithms: elliptic curve digital signature algorithm for digital signatures and SHA-256 as a hash function. A quantum computer could use Shor’s algorithm to get our private from our public key, but the most optimistic scientific estimates say that even if this were possible, it will not happen during this decade. Quantum cryptography is different from traditional cryptographic systems in that it relies more on physics, rather than on mathematics, as a key aspect of its security model. Quantum cryptography uses photons to transmit a key. Once the key is transmitted, coding and encoding using the normal secret-key method can take place. Regular, non-quantum encryption can work in a variety of ways, but, generally, a message is scrambled and can only be unscrambled using a secret key.
The digital currency Bitcoin has had remarkable growth since it was first proposed in 2008. Its distributed nature allows currency transactions without a central authority by using cryptographic methods and a data structure called the blockchain. Imagine that you could run the Bitcoin protocol on a quantum computer. What advantages can be had over classical Bitcoin? This is the question we answer here by introducing Quantum Bitcoin which, among other features, has immediate local verification of transactions. This is a major improvement over classical Bitcoin since we no longer need the computationally-intensive and time-consuming method of recording all transactions in the blockchain. Quantum Bitcoin is the first distributed quantum currency, and this paper introduces the necessary tools including a novel two-stage quantum mining process. In addition, we have counterfeiting resistance, fully anonymous and free transactions, and a smaller footprint than classical Bitcoin.
The advent of quantum computing threatens blockchain protocols and networks because they utilize non-quantum resistant cryptographic algorithms. When quantum computers become robust enough to run Shor's algorithm on a large scale, the most used asymmetric algorithms, utilized for digital signatures and message encryption, such as RSA, (EC)DSA, and (EC)DH, will be no longer secure. Quantum computers will be able to break them within a short period of time. Similarly, Grover's algorithm concedes a quadratic advantage for mining blocks in certain consensus protocols such as proof of work. Today, there are hundreds of billions of dollars denominated in cryptocurrencies and other digital assets that rely on blockchain ledgers as well as thousands of blockchain-based applications storing value in blockchain networks. Cryptocurrencies and blockchain-based applications require solutions that guarantee quantum resistance in order to preserve the integrity of data and assets in these public and immutable ledgers. The quantum threat and some potential solutions are well understood and presented in the literature. However, most proposals are theoretical, require large QKD networks, or propose new quantum-resistant blockchain networks to be built from scratch. Our work, which is presented in this paper, is pioneer in proposing an end-to-end framework for post-quantum blockchain networks that can be applied to existing blockchain to achieve quantum-resistance. We have developed an open-source implementation in an Ethereum-based (i.e., EVM compatible) network that can be extended to other existing blockchains. For the implementation we have (i) used quantum entropy to generate post-quantum key pairs, (ii) established post-quantum TLS connections and X.509 certificates to secure the exchange of information between blockchain nodes over the internet without needing a large QKD network, (iii) introduced a post-quantum second signature in transactions using Falcon-512 post-quantum keys, and (iv) developed the first on-chain verification of post-quantum signatures using three different mechanisms that are compared and analyzed: Solidity smart-contracts run by the validators for each transaction, modified EVM Opcode, and precompiled smart contracts.
Bitcoin already faces a quantum threat through Shor attacks on elliptic-curve signatures. This paper isolates the other component that public discussion often conflates with it: mining. Grover's algorithm halves the exponent of brute-force search, promising a quadratic edge to any quantum miner of Bitcoin. Exactly how large that edge grows depends on fault-tolerant hardware. No prior study has costed that hardware end to end. We build an open-source estimator that sweeps the full attack surface: reversible oracles for double-SHA-256 mining and RIPEMD-based address preimages, surface-code factory sizing, fleet logistics under Nakamoto-consensus timing, and Kardashev-scale energy accounting. A parametric sweep over difficulty bits b, runtime caps, and target success probabilities reveals a sharp transition. At the most favourable partial-preimage setting (b = 32, 2^224 marked states), a superconducting surface-code fleet still requires about 10^8 physical qubits and about 10^4 MW. That load is comparable to a large national grid. Tightening to Bitcoin's January 2025 mainnet difficulty (b about 79) explodes the bill to about 10^23 qubits and about 10^25 W, approaching the Kardashev Type II threshold. These numbers settle a narrower question than "Is Bitcoin quantum-secure?" Once Grover mining is lifted from asymptotic query counts to fault-tolerant physical cost, practical quantum mining collapses under oracle, distillation, and fleet overhead. To push mining into non-trivial consensus effects, one must invoke astronomical quantum fleets operating at energy scales that lie far above present-day civilization.