A lot of people hear a scary version of this claim: “Quantum computers will break crypto by turning any address into its private key.” That is not how the risk works.
The beginner-friendly answer is this: cryptocurrencies such as Bitcoin and Ethereum use public-key cryptography. A private key creates a public key, and the public key is then used directly or indirectly to create an address. The main quantum threat is not “reverse any address into a private key.” The real concern is that a sufficiently powerful quantum computer could break some of the math behind today’s public-key systems once it has the public key to attack. NIST says quantum computers powerful enough for this could eventually break many of today’s public-key cryptosystems, including elliptic-curve systems.
Start with the three things people mix up
To understand the topic, you need to separate three different things:
A private key is the secret. Whoever knows it can authorize spending. A public key is derived from the private key and is meant to be shareable. An address is usually a shorter identifier derived from the public key in a wallet-friendly format. In other words, the normal direction is:
private key → public key → address.
That arrow matters. In normal cryptography, going forward is easy, but going backward is supposed to be hard. On a normal computer, you can derive the public key from the private key, but you cannot realistically derive the private key from the public key. That one-way property is what keeps funds secure.
What a Bitcoin address actually represents
In traditional Bitcoin addressing, the address is not the public key itself. Bitcoin’s developer docs describe a typical P2PKH flow where the address is built from a hash of an ECDSA public key, specifically a RIPEMD-160 of a SHA-256 hash of that public key, then encoded for use as an address. Bitcoin’s docs also note that in many cases users distribute hashes instead of public keys, with the actual public key only revealed when the outputs are spent.
That means a Bitcoin address usually hides the public key until spending time. So if someone only knows your address, they usually do not automatically have the public key needed for the more dangerous kind of quantum attack.
What an Ethereum address represents
Ethereum also uses a private/public key pair, but the address is formed differently. Ethereum’s documentation says the public key is generated from the private key, and the public address is the last 20 bytes of the Keccak-256 hash of that public key. So Ethereum absolutely uses a public key too; the address is just a shortened hash-derived identifier rather than the key itself.
This is why saying “an address” and “a public key” are the same thing is wrong for both Bitcoin and Ethereum.
So what does a quantum computer actually threaten?
NIST’s post-quantum materials say quantum computers would completely break many public-key cryptosystems, including elliptic-curve cryptosystems, and specifically identify ECDSA and related elliptic-curve systems as vulnerable to Shor’s algorithm on a cryptographically relevant quantum computer. NIST also explains that such machines are still a future threat rather than something ordinary users face from current systems.
For cryptocurrency beginners, the practical meaning is simple: a powerful enough quantum computer could attack the public-key step. If it gets a public key, it may be able to recover the corresponding private key far more efficiently than a classical computer could. That is the big issue.
Why “address alone” is different from “public key known”
This is the point many people miss.
If an attacker only has an address, that is usually not the same as having the public key. In Bitcoin’s common address style, the address is based on a hash of the public key, and Bitcoin’s own docs say the actual public key is often only distributed when the output is spent. So an address by itself does not usually hand a quantum attacker the exact thing they most want.
That is why the statement “quantum computers can reverse any address into its private key” is misleading. The more accurate statement is: if the public key becomes available, then the signature system behind many current cryptocurrencies becomes the dangerous part.
Why Bitcoin and Ethereum feel different in these discussions
Bitcoin often gets described as “safer until you spend” because many standard outputs reveal only a public-key hash at first, and the actual public key is revealed later when spending. Ethereum accounts are also derived from public keys, but signed Ethereum transactions expose enough information that the public key can be recovered from them in practice. Ethereum’s docs make clear that Ethereum accounts are based on public-private key cryptography and that the address comes from the public key.
So the rough beginner summary is:
Bitcoin often hides the public key until spend time. Ethereum accounts do use a hidden public key too, but once an account transacts, the public-key information needed to validate the signature is effectively out in the open.
Can multiple public keys generate the same address?
In theory, yes. In practice, this is treated as astronomically unlikely.
Why? Because an address is usually derived from a hash or other compressed representation of the public key. Whenever you squeeze a huge set of possible inputs into a smaller output space, collisions must exist mathematically somewhere. Bitcoin’s docs, for example, describe traditional addresses as 20-byte hashes, while public keys themselves are larger objects. So in pure theory, different public keys could map to the same address.
But the key point is that “must exist in theory” is not the same as “might happen in practice.” Good cryptographic hash constructions are designed so that finding such a collision is computationally infeasible.
If two public keys did map to the same address, who could spend the coins?
For a public-key-hash style output, the locking rule is effectively “provide a public key whose hash matches this address, and provide a valid signature for that public key.” So if two different public keys somehow produced the same address hash, then either corresponding private key could, in principle, satisfy that condition.
In real life, that would not mean both parties could spend the same coins forever. It would mean there are two possible valid claimants to the same unspent output, and whichever valid transaction confirms first would consume it. After that, there is nothing left for the other key to spend. That part is just standard transaction logic.
Does quantum computing help find one of those “same address” collisions?
That is not the main danger people mean when they say quantum computing threatens crypto.
The main threat NIST highlights is to public-key cryptography, especially systems based on RSA and elliptic curves. That is a different problem from finding two different public keys that hash to the same address. Even if quantum computers can speed up some search problems, the headline risk to cryptocurrencies is still the ability to break the signature system once a public key is available, not the ability to magically hunt down address collisions as the main attack path.
A simple mental model
Think of it like this:
Your private key is the secret stamp in your pocket.
Your public key is the pattern that lets everyone verify your stamp is real.
Your address is more like a label derived from that pattern so people know where to send funds.
A quantum computer is not mainly scary because it can look at the label and instantly guess the secret stamp. It is scary because, if it gets the verification pattern, future quantum attacks could undermine the math that keeps the secret stamp unforgeable.
Are cryptocurrencies already broken today?
No. NIST’s public materials describe this as a future threat, and NIST notes that running Shor’s code-breaking algorithm would likely require a quantum computer with very large numbers of qubits operating with extremely low error rates; one NIST explanation says this may require millions of qubits running error-free indefinitely.
So this is not the same as saying someone with a lab machine today can type in your wallet address and steal your coins. The concern is that the industry needs time to migrate before quantum hardware becomes strong enough to matter.
The safest beginner takeaway
If you remember only four things, remember these:
First, cryptocurrencies like Bitcoin and Ethereum do use public keys.
Second, an address is usually derived from a public key, not the other way around.
Third, the most important quantum threat is not “address to private key,” but “public key to private key” against today’s vulnerable public-key systems.
Fourth, that threat is serious enough that NIST has already standardized post-quantum cryptography for future migration, but it is still a migration problem for the future, not proof that cryptocurrencies are already broken today.
Final answer in one sentence
Quantum computers do not mainly threaten crypto by turning a wallet address directly into a private key; they threaten it by breaking the public-key cryptography that protects spending, especially once the relevant public key is exposed.
