While quantum computers are of limited use in inverting a hash function (which remains infeasible for 256-bit hash functions), they would be a tremendous boon f

While quantum computers are of limited use in inverting a hash function (which remains infeasible for 256-bit hash functions), they would be a tremendous boon for cryptocurrency mining on a Hashcash proof-of-work system, such as the one used in bitcoin. In fact this is an obvious application of Grover's algorithm [1] that can find an input x satisfying a predicate P(x) in time O(sqrt(N)) where N is the domain size of P. The predicate P in this case is just that SHA256(SHA256(x)) < difficulty_target, while N is about 2^70 at the current difficulty level. This gives a nice speedup, even if the quantum computer cycle time is a million times slower. As a result, mining would centralize to outfits having the most advanced quantum hashing chips. Of course this ignores the bigger issue bitcoin would have with its signature scheme being completely broken on quantum computers, rendering all exposed public keys unsafe (addresses, being hashes of public keys, remain safe until spent though; hence the recommendation against address re-use). [1] https://en.wikipedia.org/wiki/Grover's_algorithm https://en.wikipedia.org/wiki/Grover's_algorithm