Is this Bitcoin quantum-exposed?

No — not today. But the timeline and the mechanism are specific enough to take seriously.

Bitcoin addresses use ECDSA (Elliptic Curve Digital Signature Algorithm) over the secp256k1 curve. Breaking a private key from a public key requires solving the elliptic curve discrete logarithm problem. A sufficiently powerful quantum computer running Shor's algorithm could do this. "Sufficiently powerful" currently means roughly 2,000–4,000 logical (error-corrected) qubits. The best quantum computers today have hundreds to low thousands of physical qubits with high error rates — logical qubit counts remain far below the threshold.

The distinction that matters — exposed vs. unexposed addresses:

• A Bitcoin address that has never signed a transaction reveals only its hash, not its public key. A quantum computer cannot derive the private key from a hash alone (that would require breaking SHA-256/RIPEMD-160, which Grover's algorithm weakens but does not break in any practical sense).
• An address that has signed at least one transaction has broadcast its public key to the chain. That public key is the input to Shor's algorithm. These addresses are the ones that become vulnerable when quantum capability crosses the threshold.

The checker identifies whether an address falls into the exposed category. It is not a definitive security audit — it is a first-order screening based on public on-chain data.

Exposed (public key on chain):

• P2PK (pay-to-public-key) — used by Satoshi-era coins. The public key sits in the output script itself, exposed before the address is ever spent
• Any P2PKH, P2WPKH or P2TR address that has already spent at least once — the spending transaction reveals the public key
• Reused addresses (any type) — once a UTXO is spent the public key is permanent and public

Unexposed (hash only on chain):

• Fresh P2PKH, P2WPKH or P2TR addresses that have only received, never sent
• Coins held in a wallet that always sweeps to a fresh address after each spend

Best practice for quantum-aware custody is one-spend-per-address. The checker flags reused addresses because they are exposed regardless of how recently they were created.

There is no consensus date. Public estimates from credible sources cluster in three bands:

• 2030–2035: aggressive — assumes major breakthroughs in qubit error rates. Held by some industry leaders (IBM, Google) and a minority of academics
• 2035–2045: consensus — the range cited by NIST, CISA and most national-security analyses
• 2045+ or never: skeptical — assumes scaling barriers prove fundamental, not engineering. A respected minority view

The decision-relevant question isn't when capability arrives, it's how long the migration takes for your specific custody setup. If migration is a 2–3 year project and the conservative arrival date is 2035, the planning window is now.

It is a meaningful step, not a permanent fix. Moving coins from an exposed address to a fresh, never-signed one reduces the attack surface from the elliptic-curve layer (which Shor's algorithm breaks) to the hash layer (which Grover's algorithm only weakens). The fresh address is safe until you spend from it.

What it doesn't solve:

• The moment you spend from the new address, its public key is published and the clock resets
• If a cryptographically relevant quantum computer exists when you broadcast that spend, an attacker could potentially race to derive the key from the public key before the transaction confirms — the so-called "front-running" attack
• Multi-sig and time-locked outputs have their own exposure profiles that simple sweeping doesn't fix

The long-term answer is a Bitcoin protocol upgrade to post-quantum signature schemes. Sweeping to fresh addresses buys the time required to coordinate that upgrade.