Bitcoin

<h2 id="header-0">Key Facts</h2>
<ul>
 <li>Galaxy and a nine-member consortium including BlackRock, Coinbase, Fidelity and Strategy committed $20 million to Bitcoin quantum defense across two announcements two days apart in July.</li>
 <li>Roughly 6.9 million BTC, about a third of every coin ever mined, already sits in addresses whose public keys have been exposed on-chain.</li>
 <li>Custodians are shipping now, with BitGo's Quantum Risk Score live since July and Coinbase targeting an automated post-quantum signing pipeline within about a year.</li>
</ul>
Two announcements around Bitcoin (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/bitcoin/">BTC</a>) security landed two days apart this past July. On July 21, Galaxy <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.galaxy.com/newsroom/galaxy-launches-bitcoin-quantum-readiness-initiative">launched</a> a $5 million Bitcoin Quantum Readiness Initiative to fund developers who build post-quantum tools.
<img src="https://academy-public.coinmarketcap.com/optimized-uploads/33a7f91ba0b84fe0a0b1916bccc4e1f1.png">
Two days later, nine of Bitcoin's biggest names <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/blackrock-coinbase-strategy-bitcoin-quantum-security-consortium">unveiled the Bitcoin Security Consortium and pledged $15 million over three years</a>. The new group includes BlackRock, Coinbase, Fidelity and Strategy. It's the first time these firms have put a number on quantum defense together.
Yet how close that hardware threat is remains disputed. Benchmark analyst Mark Palmer <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.theblock.co/news/regulation/2026-01-29-bitcoins-quantum-risk-long-dated-benchmark-pushes-back-panic-387704">called</a> it real but distant, putting capable machines at least another 10 to 20 years off, possibly longer.
That defense money doesn't decide what happens to Bitcoin's protocol—no funder can, in a <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/decentralized-network">decentralized network</a>—but some of it goes straight at the code. Galaxy's grants pay developers to review and build quantum-resistant BIPs, integrate post-quantum signatures, and audit the implementations.
CoinMarketCap Academy has <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/quantum-computers-bitcoin-2026-q-day">covered that separate protocol fight elsewhere</a>.&nbsp;
This piece stays at the company and product level. It tracks who's spending money and shipping products now. It also asks whether that spending outruns the real danger.
That comparison rests on one mechanism. Most Bitcoin addresses hide their <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/public-key">public key</a> until you spend from them; spending publishes that key on-chain. <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/taproot">Taproot addresses</a> work differently: the newer format puts the public key in the address itself, exposed the moment you receive coins, not just when you spend them.
A powerful quantum computer could someday reverse that key, exposing the private key controlling your coins.
<h2 id="header-1">Two Bitcoin Quantum Funding Pushes, Two Speeds</h2>
Despite its name, the consortium has no shared pot. Each of the nine members funds its own research.
Mike Schmidt coordinates it day to day. He's an <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/blackrock-coinbase-strategy-bitcoin-quantum-security-consortium">unpaid volunteer</a> who runs the Bitcoin nonprofit Brink.
The launch announcement named no recipients. Galaxy's smaller initiative, announced two days earlier, <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.theblock.co/post/409129/galaxy-bitcoin-quantum-computing-threat-initiative">named</a> its advisory council in the same breath.
BlackRock's head of digital assets, Robert Mitchnick, called Bitcoin Core developers' work "incredibly important." But the consortium itself won't direct that work or take sides on protocol changes.
It funds research on the margins of the problem, rather than a fix to it.
That narrow scope sounds like a limit, but the coins at risk are hard to move fast anyway. CoinShares <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinshares.com/us/insights/research-data/quantum-vulnerability-in-bitcoin-a-manageable-risk/">sized</a> this up directly, reporting that about 1.6 million BTC sits in Bitcoin's oldest address format, where the public key has always been exposed.
<img src="https://academy-public.coinmarketcap.com/optimized-uploads/60cc583a79e64aff8134cae75c6651b9.png">
Source: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinshares.com/us/insights/research-data/quantum-vulnerability-in-bitcoin-a-manageable-risk/">CoinShares</a>
Only about 10,200 BTC of that sits in outputs big enough, on their own, to shake the market. The rest, spread across more than 32,000 individual <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/unspent-transaction-output">UTXOs</a> averaging about 50 BTC each, is too scattered to move fast.
Bernstein <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/bitcoin-has-3-5-years-to-prepare-for-quantum-threat-says-bernstein">called</a> that risk neither existential nor novel, while still giving Bitcoin only three to five years to prepare.&nbsp;
Quantum-hardware maker IonQ <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.ionq.com/resources/ionqs-fully-compiled-end-to-end-resource-estimate-for-breaking-256-bit-elliptic-curve-signatures">published</a> a different read. Its study estimated a 20,000-qubit machine would need about 26 days to break Bitcoin's encryption. It tied that qubit count to its own hardware roadmap for around 2028.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/86fc60df6fd24858b31075dab4ff5e16.png">
Source: IonQ
Set against that split, the funding looks less like overreaction and more like a hedge against real disagreement.
<h2 id="header-2">How Coinbase Is Rebuilding Custody for Quantum</h2>
Coinbase's CoreKMS system already <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.coinbase.com/blog/what-coinbase-is-doing-to-prepare-for-post-quantum-cryptography">protects</a> roughly 99.9% of customer funds. It splits each private key into encrypted shares held across separate machines.
The setup is called <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/what-are-multi-party-computation-mpc-wallets">multi-party computation</a>. No single machine ever holds a full key.
Coinbase is now building a post-quantum version, called PQ-CoreKMS. It's targeting an automated signing pipeline within about a year.
Full support for lattice-based signatures is two to three years out. That's the math the National Institute of Standards and Technology (NIST) picked as its standard.
Lattice keys are harder to split across machines. That's why that piece lags.
Coinbase's own outside advisers won't put a date on it. Its Independent Advisory Board expects a working quantum computer eventually, with an <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/coinbase-report-flags-quantum-risk-gaps-across-major-blockchains">estimate that the threat is at least a decade away</a>.
In June, the same board pushed harder. It <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.coinbase.com/blog/coinbase-quantum-advisory-council-post-quantum-migration-and-abandoned-coins">told</a> developers to start migration work now and stop debating when the threat lands.
Coinbase isn't waiting for the far end of that window. It pressure-tested its plan with a closed-door workshop, co-hosted with Stanford cryptographer Dan Boneh and Localhost Research.
It <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.coinbase.com/blog/moving-bitcoins-post-quantum-readiness-forward">published</a> its takeaways on Sept. 9. The group reached no consensus on which fix to use, though they agreed migration will happen gradually, in stages.
<h2 id="header-3">How BitGo and Anchorage Cut Quantum Exposure</h2>
The same urgency has reached products already shipping, though the buyers here are institutions. On July 9, BitGo <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.bitgo.com/btc-quantum-resistance-score/">launched</a> a Quantum Risk Score for its custody clients. It rates a wallet's exposure, then walks them to a fresh address.<img src="https://academy-public.coinmarketcap.com/optimized-uploads/7fc708443faf461199e2f5298ae53c98.png">
BitGo’s Bitcoin Quantum Resistance Score
CEO Mike Belshe's logic is simple: the safest key is one whose public key has never been <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.businesswire.com/news/home/20260709199344/en/BitGo-Announces-New-Quantum-Risk-Management-Capabilities-for-Bitcoin-Wallets">revealed</a> on-chain.
BitGo went further in May, <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.businesswire.com/news/home/20260526229210/en/BitGo-and-Silence-Laboratories-Complete-First-Post-Quantum-MPC-Transaction-Simulation-by-a-Regulated-Custodian">signing</a> a test transaction with Silence Laboratories using ML-DSA, a NIST-approved scheme. It remained a simulation, however, as Bitcoin itself still can't accept that kind of signature.
Anchorage Digital solves the same problem differently, by avoiding exposure in the first place. Its addresses are <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.anchorage.com/insights/anchorage-digital-outlines-industry-leading-post-quantum-compute-preparedness-strategy">hash-based</a>, built from a hash of the key rather than the key itself.
That protection holds while the coins sit still. Anchorage calls it quantum-safe "at rest." Spend from one of those addresses, though, and the same rule applies as anywhere else on Bitcoin: spending reveals the public key.
Anchorage's research team has floated a “<a target="_blank" rel="noopener noreferrer nofollow" href="https://learn.anchorage.com/Anchorage-Digital-Quantum-Turnstile-Merged.pdf">Post-Quantum Turnstile</a>,” though it hasn't built one. It would be for keys that have never been exposed, letting owners move to post-quantum protection without ever revealing that key.
Coins already exposed fall outside it. They need the ordinary fix instead: a move to a fresh address.
But why the rush, if hardware is years off? Rules are pushing this timeline.
<a target="_blank" rel="noopener noreferrer nofollow" href="https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf">NIST's draft plan</a> bars federal use of Bitcoin's encryption strength after 2035. A weaker version of the same algorithm loses approval five years sooner. A June 2026 <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.whitehouse.gov/wp-content/uploads/2026/06/eo-14412.pdf">executive order</a> made similar 2030 and 2031 deadlines binding for federal agencies, though not automatically for private custodians like BitGo and Anchorage. Even so, both are building to the same clock their regulators are watching.
<h2 id="header-4">Trezor, AmericanFortress Sell Quantum Safety Early</h2>
The retail story runs through hardware too. Trezor markets its Safe 7 as <a target="_blank" rel="noopener noreferrer nofollow" href="https://trezor.io/guides/trezor-devices/trezor-safe-7/the-first-quantum-ready-hardware-wallet">quantum-ready</a>. Trezor's two post-quantum schemes on the $249 device each do a different job.
SLH-DSA-128 verifies the firmware at boot. ML-DSA-44, a separate algorithm, handles device attestation, proving the hardware itself is genuine.
That protects the device. It doesn't protect your coins.
The Bitcoin-spending signature still runs on today's elliptic-curve math—the same math a quantum computer could someday break.
Trezor hasn't disclosed unit sales, so it's unclear whether the label is moving hardware.
AmericanFortress is tackling the same problem in software, on a timeline that has already slipped. It <a target="_blank" rel="noopener noreferrer nofollow" href="https://ca.finance.yahoo.com/news/exclusive-americanfortress-raises-8m-build-132208606.html">raised</a> $8 million in May, aiming for a token launch that quarter. The quarter passed, and the company now <a target="_blank" rel="noopener noreferrer nofollow" href="https://americanfortress.io/">cites</a> ongoing "technical and legal review."<img src="https://academy-public.coinmarketcap.com/optimized-uploads/170ca2b88ccb46639994b6d30841a096.png">
Source: AmericanFortress
In July, the company <a target="_blank" rel="noopener noreferrer nofollow" href="https://decrypt.co/374651/new-research-bitcoin-wallet-quantum-attacks-safe">published</a> ZKPoSP, a scheme built on a <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/zero-knowledge-proof">zero-knowledge proof</a>. That's a way to prove you know a secret, your seed phrase, without revealing it.
Under the proposal, the wallet would never sign with a private key. Instead, it would prove ownership with a zero-knowledge proof, so no public key would touch the chain. That doesn't undo old exposure, though: a public key already revealed by a past spend remains exposed.
The catch is that it's unproven. The scheme's own <a target="_blank" rel="noopener noreferrer nofollow" href="https://eprint.iacr.org/2026/1508">technical paper</a> calls its post-quantum security "conjectured." No blockchain has adopted it yet.
<h2 id="header-5">Check Your Own Bitcoin Quantum Exposure</h2>
None of that corporate timeline changes what you can check yourself right now—the mechanism from the start of this piece. A Bitcoin address reveals its full public key only once you spend from it, except for Taproot addresses, which reveal it the moment you receive coins.
Roughly <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/google-cuts-quantum-threat-estimate-putting-bitcoin-timeline-in-question">6.9 million BTC, about a third of everything ever mined, already sits exposed</a> that way. The figure covers every address BTC was ever spent from, well beyond the concentrated holders sized up earlier.
You can check your own history the same way. If your coins sit in a non-Taproot address and have never left it, the key hasn't been published yet. Spending is what exposes it, no matter which wallet or custodian you use.

Is Bitcoin Quantum-Safe? BTC Custodians Aren't Waiting to Find Out

Table of Contents

Other articles published on Sep 29, 2026

Bitcoin Volatility Hits 3-Year Low as Bitfinex Eyes $95K in October

NEAR Price Jumps 10% as First US NEAR ETF Draws $35.5M on Debut

Bitcoin Price Stalls Below $85K as CryptoQuant Flags Correction Risk

Join our free newsletter for daily crypto updates!