The canary in the coal mine
Not entirely, and the honest answer depends on one detail: whether an address has ever exposed its public key. The Bitcoin Puzzle happens to contain both cases side by side, with real money on each, which makes it the best public early warning system for the quantum threat that exists.
Shor's algorithm is the dangerous one. Given a public key, a sufficiently powerful quantum computer can compute the private key directly, in hours rather than eons. The catch is the input: it needs the public key itself, not the address. Bitcoin addresses are hashes of public keys, so an address that has never spent keeps its key hidden. But every address that has ever sent a transaction revealed its key on the blockchain, and every Taproot address embeds its key in the address itself. Researchers at Deloitte estimate that around 4 million BTC sit on addresses with exposed public keys today.
Grover's algorithm is the fallback when the public key stays hidden. It speeds up brute force quadratically, effectively cutting the bit length in half: a 256 bit search becomes a 128 bit one. That sounds dramatic, but 2128 quantum operations is still on the order of 1022 years at optimistic speeds. For a normal, never spent from Bitcoin address, quantum computers change essentially nothing.
The hardware bar keeps dropping on paper. A March 2026 Google Quantum AI whitepaper put the cost of breaking 256 bit elliptic curve cryptography below a million physical qubits, roughly a twentyfold reduction from earlier estimates. Today's machines are far smaller, but the direction of travel is clear, and that is exactly why an early warning system matters.
In 19th century coal mines, canaries died from toxic gas before miners could sense it, buying precious time to evacuate. The Bitcoin Puzzle plays the same role for quantum computing, and it does so by design rather than by accident.
The creator deliberately exposed the public keys of the highest unsolved puzzles (#135, #140, #145, #150, #155, #160). To Shor's algorithm these addresses are exactly as breakable as any exposed key wallet on the network, no easier and no harder. What makes them special is their status: they are unclaimed bounties, placed on purpose to be found. A researcher who gets access to a capable quantum computer is far more likely to claim a legal, victimless prize than to steal from someone's personal wallet.
The signal to watch: if the exposed key puzzles fall one after another within days or weeks, quantum attacks on Bitcoin have moved from theory to practice. Coins on any address with an exposed public key would be at real risk from that day on.
A second, grimmer signal would be sudden movement of ancient coins: if long dormant early wallets, whose public keys sit exposed in old P2PK outputs, start emptying in clusters, someone is likely sweeping them with Shor's algorithm rather than a recovered seed phrase.
These unsolved puzzles have exposed public keys and live balances. Each is breakable by Shor's algorithm the moment the hardware exists.
The practical guidance follows directly from the two attacks. Coins on an address that has never sent a transaction are protected by hashes, and Grover's algorithm cannot realistically touch a 256 bit key, so they are quantum safe for the foreseeable future. Coins on a reused address (one that has spent and then received again) or on a Taproot address sit behind an exposed public key and would be vulnerable to Shor's the day the hardware arrives. Until Bitcoin adopts post quantum signatures, the simple hygiene of not reusing addresses is also the best available quantum defense.
For the deeper dive into address formats and the Shor versus Grover math, see the quantum FAQ on the home page. To understand the challenge behind the canary, start with what the Bitcoin Puzzle is, and track the unsolved puzzles to watch the frontier move.