Fidelity Warns Bitcoin’s Private Keys Face Future Quantum Risk

Fidelity Digital Assets has issued a new research warning that future quantum computers could theoretically derive Bitcoin private keys from exposed public keys, placing user funds at risk unless the network adopts quantum-resistant cryptographic upgrades. The analysis, published Sept. 1, notes that while cryptographically relevant quantum computers (CRQCs) do not exist today, sufficiently capable future systems could undermine the mathematical assumptions securing Bitcoin transaction authorization. The report highlights a proposed hash-based signature system called SHRINCS as a potential safeguard, though it acknowledges significant trade-offs in transaction throughput and wallet recovery complexity. The Core Threat: Exposed Public Keys and Shor’s Algorithm Fidelity’s research flags a fundamental vulnerability in Bitcoin’s transaction architecture. Private keys allow bitcoin owners to authorize transactions without relying on an intermediary. Wallets use a private key to produce a digital signature that proves control without disclosing the secret key. This relationship between private keys, public keys, and transaction signatures forms the foundation of Bitcoin ownership and self-custody. The report states that a sufficiently powerful quantum computer running Shor’s algorithm could solve the elliptic curve discrete logarithm problem and derive private keys from corresponding public keys. Most standard Bitcoin transactions use the Elliptic Curve Digital Signature Algorithm or Schnorr signatures. Schnorr signatures became available through Taproot, with Bitcoin Improvement Proposal 340 specifying Schnorr signatures and BIP 341 establishing Taproot’s spending rules. BIP 341 was assigned in January 2020 before the upgrade activated in 2021. Both schemes rely on the difficulty of solving the elliptic curve discrete logarithm problem with classical computers. Fidelity notes that research has reduced some estimates for the resources needed to attack elliptic-curve cryptography, bringing the Bitcoin quantum-security debate into greater focus, although existing quantum systems remain far below cryptographically relevant capacity. The Proposed Solution: Shrincs and Hash-based Signatures Researchers are evaluating quantum-resistant signature systems that rely on hash functions rather than elliptic-curve cryptography. The SHRINCS draft specification combines a compact stateful signature path with a larger stateless fallback. Its current design specifies a 48-byte public key, stateful signatures ranging from 548 to 4,619 bytes, and a 5,777-byte stateless signature. The stateful path requires signing devices to track which one-time signature keys have already been used. Lost or corrupted state prevents the wallet from safely continuing through that path, while SHRINCS’ fallback draws on algorithms from the National Institute of Standards and Technology’s SLH-DSA standard published Aug. 13, 2024. The stateless alternative preserves access but consumes substantially more block space. Signature Scheme Type Size in Bytes Role in Post-Quantum Security Public Key (SHRINCS) 48 bytes Compact identity verification Stateful Signature (SHRINCS) 548 - 4,619 bytes Efficient but requires state tracking Stateless Signature (SHRINCS) 5,777 bytes Fallback preserving wallet access Throughput Vs. Security: the Central Trade-off Fidelity Digital Assets Research identified transaction throughput as a central constraint for any future Bitcoin security upgrade: “Minimizing key size to preserve Bitcoin’s transaction throughput remains a key concern, although the impact may be less pronounced considering the current state of a near-empty mempool.” The analysis suggests that while larger signatures would reduce the number of transactions per block, the current low mempool pressure could mitigate the immediate impact. However, wallet recovery would become more complicated under a quantum-resistant regime. The stateful path’s requirement to track used one-time signing keys introduces a new operational burden for wallet software. If a device loses its state, the fallback stateless mechanism ensures access but at a much higher block-space cost. Fidelity Digital Assets Research described how a future quantum-resistant Bitcoin upgrade could accommodate different security requirements. The report frames the transition as a long-term planning issue rather than an imminent crisis, but urges stakeholders to consider the implications now. Market Impact and Industry Response The warning arrives as institutional interest in Bitcoin continues to evolve around self-custody and long-term storage solutions. Fidelity’s role as a major asset manager lends weight to the analysis, signaling that even traditional finance players are tracking post-quantum cryptography developments. No immediate market reaction was observed from the report’s publication, as the threat remains theoretical and distant. However, the research underscores a growing consensus that blockchain networks must plan for cryptographic agility. Other blockchain projects have begun experimenting with quantum-resistant signatures, but Bitcoin’s massive user base and conservative upgrade culture make any transition exceptionally difficult. The report does not propose a specific timeline for when CRQCs might arrive, nor does it suggest that Bitcoin is currently vulnerable. Instead, it emphasizes that the window for preparing a response is wide, but the engineering challenges are substantial. Fidelity’s analysis also notes that simply replacing the signature algorithm would require coordination across the entire network, including miners, node operators, wallet developers, and exchanges. A hard fork or soft fork implementing quantum-resistant signatures would need broad consensus. The report references existing standards like NIST’s SLH-DSA as building blocks, suggesting that a future Bitcoin upgrade could draw on federally vetted cryptographic primitives. The broader implications extend beyond Bitcoin. Many cryptocurrencies share the same elliptic-curve cryptography foundation, meaning Fidelity’s warning applies across the digital asset ecosystem. Exchanges, custodians, and self-custody users alike should monitor post-quantum cryptographic research as it evolves. What Is a Cryptographically Relevant Quantum Computer? A cryptographically relevant quantum computer, or CRQC, is a hypothetical future machine powerful enough to break current public-key cryptography systems. It does not need to be a full-scale universal quantum computer - only one capable of running specific algorithms like Shor’s algorithm at sufficient scale to solve problems such as the elliptic curve discrete logarithm problem. No such machine exists today, but researchers continue to lower the estimated resource requirements. Why Does Shor’s Algorithm Threaten Bitcoin? Shor’s algorithm is a quantum algorithm that can efficiently solve integer factorization and discrete logarithm problems. Bitcoin’s digital signatures rely on the difficulty of solving these problems with classical computers. A quantum computer running Shor’s algorithm could derive a private key from a public key once it has enough qubits and error correction. This would allow an attacker to spend funds from exposed addresses. What Is the Difference Between Stateful and Stateless Signatures? Stateful signatures require the signing device to track which one-time keys have already been used, like a book of checks. If that tracking information is lost or corrupted, the wallet cannot safely continue using that path. Stateless signatures do not require such tracking, making them more robust but significantly larger. SHRINCS includes both options, allowing users to balance efficiency and resilience. Could a Quantum Computer Steal Bitcoin Today? No. Current quantum processors are far too small and error-prone to perform the complex calculations needed to break elliptic-curve cryptography. Fidelity’s report explicitly states that CRQCs do not currently exist. The warning is about future risk, giving the Bitcoin ecosystem time to adopt quantum-resistant signatures before the threat becomes real. Will the Bitcoin Network Need a Hard Fork to Become Quantum Resistant? Likely, but a soft fork may also be possible depending on how the upgrade is structured in each scenario. Changing the underlying signature algorithm would require consensus among miners, nodes, and wallet providers. Fidelity’s report does not specify a particular upgrade path, but highlights NIST’s SLH-DSA standard and the SHRINCS specification as potential technical foundations for such a transition.