> Also my understanding is that quantum can only reduce complexity by sqrt, so 2^256 problem is reduced only to 2^128 which is unsolvable. The sqrt speedup is

> Also my understanding is that quantum can only reduce complexity by sqrt, so 2^256 problem is reduced only to 2^128 which is unsolvable. The sqrt speedup is for Grover's unstructured search algorithm, which is the only known quantum speedup for breaking hash functions such as RIPE160 protecting public keys in P2PKH. So it would still take on the order of 2^80 quantum steps to find a hash preimage. But to find the private key corresponding to a given public key, Shor's algorithm provides exponential speedup, so a large scale quantum computer would completely break ECDSA. There are large amounts of bitcoin protected only by P2PK (i.e. without the RIPE160 hash), or protected by P2PKH with already known public keys (from widespread key reuse), so Bitcoin would be quickly destroyed by successful application of Shor's algorithm alone. That said, I consider projections of large scale quantum computers existing within 10 years wildly optimistic, even more so than nuclear fusion being "just a few decades away".