Key takeaways

  • Shor’s algorithm attacks the discrete-logarithm assumption behind Bitcoin’s ECDSA and Schnorr signatures when a public key is known.
  • Grover’s algorithm offers a quadratic speedup for generic search, including idealized searches involving hashes. It does not turn a hash into a private key.
  • Saying that a quantum computer will “break SHA-256” misstates Bitcoin’s principal quantum spending concern.
  • Mining could be affected by future quantum search, but circuit cost, competition, block timing, and difficulty adjustment all matter.

Shor and Grover matter to Bitcoin for different reasons. Shor’s algorithm gives a fundamentally new route through the mathematics behind elliptic-curve digital signatures. Grover’s algorithm searches an unstructured space more efficiently, affecting the idealized effort of brute-force problems involving hashes. One threatens a way of proving ownership when a public key is exposed; the other changes a search margin. Combining them into the phrase “quantum computers break Bitcoin encryption” explains neither.

Bitcoin does not encrypt its blockchain. Its public ledger uses digital signatures to authorize spending and cryptographic hashes for commitments, address constructions, and proof of work. The two algorithms speak to these different jobs. A simple analogy helps: Shor finds a mathematical shortcut through a lock built from a particular algebraic structure; Grover makes checking a huge pile of otherwise unstructured keys faster, but still requires many checks. The analogy is only a guide—the precise resources depend on the construction and the machine.

The comparison in one table

Question Shor’s algorithm Grover’s algorithm
Mathematical target Structured problems such as discrete logarithms Generic search for a marked answer
Bitcoin connection ECDSA and Schnorr keys on secp256k1 Hash preimages and proof-of-work search
Idealized advantage Polynomial-time method for the target problem Roughly square-root number of queries
What an attacker needs An exposed public key and a large fault-tolerant machine A suitable quantum oracle, repeated coherent search, and substantial hardware
What it does not mean Every address already displays its public key SHA-256 is simply “decrypted” or rendered useless

This table compares algorithms, not current hardware. Neither is a demonstrated Bitcoin-theft capability. The details below explain why that qualification matters.

Shor: the signature problem

Bitcoin wallets derive a public key from a private scalar on the secp256k1 elliptic curve. A signature allows anyone to verify that a spend was authorized without learning the secret scalar. Classical security relies on the difficulty of reversing that relationship: given the public point, finding the private scalar is an elliptic-curve discrete-logarithm problem.

Peter Shor’s paper showed how a quantum computer could solve discrete logarithms efficiently in the algorithmic sense. Applied at sufficient scale, that result would let an attacker derive a private key from a known secp256k1 public key. BIP 340’s Schnorr specification and Bitcoin’s older ECDSA usage differ in important protocol details, but neither escapes the underlying discrete-logarithm issue.

The practical condition is known public key. P2PK and Taproot outputs can expose public keys while unspent. P2PKH and P2WPKH outputs typically carry a public-key hash until a spend reveals the key. Reused keys can leave other unspent outputs exposed after that reveal. Our address-exposure guide unpacks this in the context of real output types.

Shor’s algorithm is not “brute-forcing” a 256-bit key faster. It exploits mathematical structure. That difference is why a sufficiently capable implementation would be qualitatively serious for signatures: unlike a modest improvement in guessing speed, it undermines the one-way relationship the signature system assumes.

Grover: the search problem

Lov Grover’s original work concerns searching an unsorted space. If a classical strategy would require a number of trials proportional to N, the idealized quantum method needs on the order of the square root of N oracle queries. The word oracle is important: the algorithm needs a reversible quantum implementation of the test for a correct answer, not merely a normal SHA-256 chip running faster.

For an ideal 256-bit preimage search, the familiar shorthand changes a 2^256-scale search into roughly 2^128 quantum queries. Those are staggeringly large numbers either way, and queries are not free: each requires a fault-tolerant circuit, while maintaining coherence across the sequence. Parallel quantum machines do not automatically turn this into a cheap, instantaneous attack.

Bitcoin also uses 160-bit HASH160 commitments in some output types. A generic quantum preimage search would have a lower idealized exponent there than for 256 bits. But an address hash is not a plain text label for a secret key. Finding some preimage, matching the required public-key structure, producing a valid signature, and beating the relevant timing and cost constraints are separate questions. The direct Shor attack on an already-visible public key is the cleaner signature threat.

That is why “quantum computers break SHA-256” is a poor summary. SHA-256 is a hash function specified in NIST FIPS 180-4. Grover changes the cost of generic search against an idealized hash target; it does not reveal every SHA-256 preimage, undo Bitcoin’s historical chain, or produce arbitrary valid signatures from a hash digest.

What about Bitcoin mining?

Bitcoin miners repeatedly vary candidate block data and test whether a double-SHA-256 block hash falls below the current target. That resembles a search problem, so Grover’s algorithm is relevant in principle. Yet a theoretical quadratic query advantage does not directly translate into a mining business advantage.

A quantum miner would need a coherent circuit for the hash calculation, repeated many times with error correction. Conventional miners use specialized hardware built to compute hashes extremely quickly and in massive parallel fleets. Bitcoin adjusts mining difficulty in response to aggregate block production over time. Blocks also arrive stochastically, so a search that must run coherently until a solution is found interacts awkwardly with a changing tip and competitors finding blocks first.

Aggarwal and coauthors’ research distinguishes signature risk from proof-of-work risk, and a later mining analysis studies conditions under which quantum mining might be advantageous. These are model-based studies, not demonstrations of an operational quantum miner. Estimates depend on hardware assumptions, which can change. It is more honest to say that mining could be affected by future quantum hardware than to claim that Grover either destroys proof of work or has no possible effect.

The security question is different from theft by signature forgery. A miner seeks a valid block, not the private key controlling somebody else’s UTXO. Even a future mining advantage would need to be analyzed in terms of hash power, incentives, and consensus behavior rather than described as “decrypting wallets.”

Why current demonstrations do not settle either question

An algorithm’s asymptotic speedup describes how resource use scales as a problem grows. It does not mean a present quantum processor has the logical qubits, low error rates, gate depth, connectivity, and runtime to solve the real instance. A laboratory demonstration on a toy curve is not a secp256k1 key recovery. A small Grover experiment is not an economically competitive Bitcoin miner.

Google Quantum AI’s 2026 secp256k1 estimates sharpen the engineering target for Shor-style key recovery. They are resource estimates, not a completed attack. As hardware and algorithms advance, the useful evidence will be reproducible logical operations at relevant depth and a credible physical implementation—not a raw count of noisy physical qubits.

This distinction also guards against overconfident forecasts. A smaller circuit estimate may shorten a hypothetical attack runtime under certain hardware assumptions. It does not provide a date when that hardware will exist. Conversely, the absence of an attack today does not prove signatures need no migration plan. The Bitcoin quantum-risk overview places both claims in context.

The right question for each algorithm

When someone invokes Shor, ask: Which exposed public key is the target, what key-recovery resources are assumed, and would a forged signature arrive in time? When someone invokes Grover, ask: What search problem and oracle are specified, how many coherent queries are required, and what classical or quantum competitor sets the real-world baseline?

Those questions prevent a technical discussion from drifting into slogans. They also suggest different responses. Signature migration addresses the clearest Shor pathway. Hash and mining analysis asks whether parameters and incentives remain adequate under plausible quantum implementations. They are related elements of Bitcoin’s long-term resilience, but they are not interchangeable problems.

The most useful takeaway is not that one algorithm is “scarier.” It is that precision changes the conversation. A future quantum computer might solve a discrete logarithm without reversing SHA-256; another might gain search speed without forging a signature. Bitcoin’s preparation has to match the actual mechanism, not the word quantum.

Sources