Which Bitcoin Addresses Are Quantum-Vulnerable?

Bitcoin uses ECDSA, and since Taproot activated in 2021, also Schnorr signatures. Both fall to Shor’s algorithm running on a sufficiently large quantum computer. That makes Bitcoin’s signature schemes quantum-vulnerable in principle.

But in practice, the exposure isn’t uniform across the protocol. Different Bitcoin address types expose the public key on chain at different stages, and the public key is the input a quantum attacker needs to derive the private key. A wallet that’s been quiet for a decade can be perfectly safe or completely exposed depending on which address format it uses.

Here’s the breakdown by address type.

P2PK (Pay-to-Public-Key)

P2PK was the dominant output type in Bitcoin’s earliest years. Most of Satoshi’s mining rewards sit in P2PK outputs from 2009 and 2010.

The script is simple. <public-key> OP_CHECKSIG. The full public key sits directly in the output, with no hash layer between it and anyone who downloads the chain.

Take Block 9, mined by Satoshi in January 2009. It paid the 50 BTC mining reward to a P2PK output, and the full 130-character public key has been visible on chain ever since.

P2PK is the most quantum-exposed Bitcoin output type today. The public key is permanent on chain, so a future quantum attacker doesn’t need to wait for the address to spend. They can begin precomputing the private key the moment they have a sufficiently capable machine.

Estimates from on-chain analysis put the total Bitcoin in P2PK outputs at about 1.7 million BTC, or 8% of total supply. Most of those coins have never moved.

P2PKH (Pay-to-Public-Key-Hash)

P2PKH replaced P2PK as Bitcoin’s standard address type and dominated the protocol for years. Addresses start with “1” and look like 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa, the P2PKH address corresponding to Satoshi’s Genesis Block public key, which has received many small tributes from Bitcoin users over the years.

The output script wraps the public key in a hash. The hash160 is RIPEMD-160 applied to SHA-256 of the public key, which compresses the full 33-byte key to a 160-bit fingerprint.

P2PKH addresses have two different quantum profiles, depending on whether they’ve ever been spent from. An address that has never been spent has only its HASH160 on chain. A quantum attacker would need to break the 160-bit HASH160 with Grover (which cuts that to about 80 bits of preimage security) just to find a public key that hashes to the target.

Once coins are sent from the address, the public key appears in the spending transaction’s input script. From that moment, the address has the same quantum exposure as P2PK.

SegWit (P2WPKH and P2WSH)

SegWit activated in August 2017 and introduced new address formats starting with “bc1q”. The single-key version, P2WPKH, stores the same HASH160 of a public key as P2PKH, just in a different transaction format. The witness data goes in the witness section of the transaction instead of the scriptSig.

The quantum profile is identical to P2PKH. Before first spend, only the hash is visible. After first spend, the public key is in the witness data.

P2WSH, the script-hash version, uses a SHA-256 hash of a script (32 bytes, 256-bit security under classical attacks, 128-bit under Grover). Its quantum exposure depends on what the redeem script contains, as does P2SH before it.

The main practical change from P2PKH was lower transaction fees. Quantum exposure stayed the same.

Taproot (P2TR)

Taproot, activated in November 2021, is where the quantum story takes a turn. Addresses start with “bc1p” and encode a 32-byte x-only public key directly. No hash layer sits between the public key and the chain.

Any Bitcoin address starting with “bc1p” is a Taproot output. The 32-byte string after the prefix, encoded in Bech32m, is the Taproot output key.

Taproot was a deliberate design choice. It prioritized Schnorr signatures and on-chain privacy improvements. Quantum resistance wasn’t part of the goal set when the design was finalized.

But Taproot is currently the worst choice for cold storage from a quantum-resistance perspective. The output stores the input a quantum attacker needs, the public key, in the clear and on chain, for as long as the coins sit there. The exposure profile matches P2PK. The only difference is that Taproot was designed in 2020 instead of 2008.

How They Rank, and What to Do About It

Ranked from worst to best for long-term holdings, the address types fall into two main camps.

P2PK and Taproot expose the public key on chain immediately and permanently. These are the highest-exposure address types in the protocol.

P2PKH, P2WPKH, P2SH, and P2WSH all hide the public key behind a hash until the address spends. While the address is unspent, the hash is the only thing on chain, and 80-bit Grover security applies to the HASH160 layer. Once these address types have been spent from, they expose the public key in the spending transaction, and from there their exposure matches P2PK and Taproot.

For coins you plan to hold for years, generate fresh P2WPKH addresses for each receive (or P2PKH if you prefer the older format), and avoid Taproot for cold storage. This buys time. The public key stays off chain until the moment you spend, which is the best Bitcoin’s current address types can offer.

Beyond that, the long-term fix is a new address type designed for quantum resistance. BIP-360, currently a draft co-authored by Hunter Beast with Ethan Heilman and Isabel Foxen Duke, introduces such a type called Pay-to-Merkle-Root (P2MR). None of the existing Bitcoin address types are quantum-resistant by design, and no deployed alternative exists yet.