Nearly every claim about quantum computers and cryptocurrency traces back to two algorithms: Shor’s (1994) and Grover’s (1996). They are routinely bundled together as “quantum computers break crypto”, which hides the single most useful fact in this field: they have wildly different power.
Shor’s algorithm destroys the mathematics behind today’s signatures. Grover’s only bruises hash functions. If you hold your own keys, that asymmetry is the whole story — it decides what is genuinely at risk and what is marketing.
Shor’s algorithm: the structural break
Public-key cryptography works because some problems are easy forwards and hard backwards. Multiply two large primes: easy. Recover the primes from the product: hard — that is RSA. Multiply a point on an elliptic curve by a secret number: easy. Recover the secret: hard — that is the discrete logarithm problem behind ECDSA and the secp256k1 curve used by Bitcoin and Ethereum, and behind Ed25519 used by Solana and others.
Shor’s insight was that both “hard backwards” problems share hidden structure — they reduce to finding the period of a repeating sequence — and that a quantum computer finds periods efficiently. Not slightly faster: exponentially faster. Security does not degrade gracefully under Shor; it collapses. There is no “use a bigger curve” fix, because key sizes would have to grow absurdly to buy trivial time.
The saving grace is the machine required. Running Shor against a 256-bit elliptic-curve key needs on the order of 1,200–1,450 logical (error-corrected) qubits executing tens of millions of clean operations — which, after error-correction overhead, means hundreds of thousands of physical qubits. The best public machines in mid-2026 run about 48 logical qubits, and the largest elliptic-curve key actually broken on quantum hardware is 15 bits, against the 256 that matter.
The threat is structural and certain in principle. The hardware is distant and uncertain in timing. Both halves are true and most coverage picks one.
Grover’s algorithm: the quadratic dent
Grover’s solves unstructured search. Given N possibilities and a way to check each, a classical computer needs about N tries; Grover needs about √N. That is a quadratic speedup — impressive, and a different universe from Shor’s exponential one.
- Hash functions. Finding an input hashing to a given SHA-256 output classically takes ~2256 tries; Grover cuts it to ~2128 quantum steps. Since 2128 remains comfortably infeasible, SHA-256 survives with its margin halved.
- Symmetric ciphers. AES-128 drops toward an effective 264 — uncomfortable — which is why conservative guidance says AES-256.
- Your seed phrase. 128 bits of entropy behaves like 64 under Grover, and 256 like 128. This is the one honest argument for a 24-word phrase, and it is a long-horizon argument rather than a present risk.
- Mining. Grover applies in principle and is blunted in practice: it parallelises poorly, while classical mining parallelises perfectly. An economics question, not a security cliff.
A crucial caveat: Grover’s √N is provably optimal for unstructured search. Barring an unforeseen structural attack on the hash functions themselves, there is no “Shor moment” waiting for SHA-256.
Why this means hash-based signatures survive
You can build signatures out of nothing but hash functions: commit to secret values by publishing their hashes, then reveal selected secrets to sign. That is Lamport’s scheme, refined into WOTS, XMSS and SPHINCS+. Forging one requires inverting a hash — a Grover-only problem.
Which is why hash-based schemes are the conservative core of post-quantum cryptography: XMSS is IETF-specified and NIST-approved, and SPHINCS+ became FIPS 205 in August 2024. It is also why the Trezor Safe 7 uses SLH-DSA-128 — and why, as that comparison notes, it still cannot protect your Bitcoin: the chains only accept elliptic-curve signatures, so the exposure lives on the network, not in your pocket.
Five misconceptions worth dropping
“Quantum computers try every answer at once.” No — they manipulate probability amplitudes so wrong answers interfere destructively. If parallel guessing were the mechanism, Grover would be exponentially fast; its modest quadratic bound proves it is not.
“Grover breaks SHA-256, so Bitcoin’s blocks are doomed.” Halving 256 bits leaves 128 — still unreachable. Difficulty adjusts; the chain structure stands.
“More qubits means closer to breaking keys.” Raw physical qubit counts are nearly meaningless without error rates. A thousand noisy qubits cannot run Shor at all. The metric is logical qubits.
“Shor’s has already factored big numbers.” Public demonstrations remain tiny. The algorithms are proven; the machines are not built.
“A quantum-safe wallet protects my Bitcoin.” It cannot. Your wallet does not choose the signature scheme — the chain does.
The line worth remembering
Shor breaks the locks; Grover just dims the lights. Signatures built on elliptic curves must eventually be replaced everywhere. Hashes — and everything honestly built on them — get to stay.
Which chains are actually doing anything about it is a separate question with an uncomfortable answer.