Chips

Will quantum computing break Bitcoin? The real threat timeline

One headline says a quantum computer could steal your Bitcoin any day now. Another says that will never happen. Both are wrong, and the real answer sits in between.

July 6, 2026 Fang Yu

Every few weeks another headline claims a quantum computer just cracked Bitcoin in minutes, or that quantum machines are about to wipe out encryption everywhere. Half the replies panic about their wallets; the other half dismiss the whole thing as hype. Both reactions skip over the complicated, genuinely important part in the middle. If you have not read what a quantum computer actually is, start with what quantum computing can and cannot do. The question here is narrower: what quantum computing actually threatens in crypto, what the "harvest now, decrypt later" risk means, how large a machine an attack would need, and where post-quantum cryptography stands today. A few of these call for action now; the rest are worth keeping an eye on.

No quantum computer today can break Bitcoin, yet one risk starts now

Today, no quantum computer on Earth can break the signature algorithms securing Bitcoin or Ethereum. The reason is a hard engineering gap: the error-corrected qubits an attack would need are several orders of magnitude beyond the strongest chips that exist right now. The next few sections lay out the actual numbers.

But "safe for now" is not "nothing to watch." One risk is not waiting ten years to start; it is quietly accumulating today. If a Bitcoin address's public key has already been exposed on-chain, that record sits permanently on a public ledger, and someone could store it now and come back to compute the private key once a capable quantum machine exists. Section 4 covers this store-now, crack-later approach: harvest now, decrypt later.

Neither "it's over" nor "it will never happen" holds up. What follows is what is actually threatened, how far the hardware has got, and what to do about it now.

What quantum actually threatens

Most people assume quantum computing threatens mining. The real target is different: the public-key signature scheme that proves a transaction was authorized by whoever owns the coins. Bitcoin and Ethereum both use ECDSA, built on an elliptic curve called secp256k1. Your wallet holds a private key only you know and a public key anyone can see; spending funds means signing with the private key, and every node checks that signature against your public key. Verifying a transaction without trusting any middleman is the same foundation that lets blockchain move value without an intermediary.

Its security rests on one hard math problem: given a public key, working backward to the matching private key takes a classical computer an impractical amount of time. What makes quantum computing worth watching is that it could, in theory, turn that problem from impossible into merely very hard.

Mining runs on a different mechanism entirely: repeatedly guessing a number until the resulting hash (SHA-256) meets a difficulty target. That has nothing to do with the math problem behind signatures, and quantum computing threatens it far less, as the next section explains.

Shor versus Grover: one is a real threat, the other is just a discount

Two quantum algorithms come up whenever this topic is discussed, and they pose wildly different levels of threat. A lot of coverage blurs them together, which is exactly where the confusion starts.

Shor's algorithm is built specifically to solve the kind of math problem Bitcoin's signatures depend on: integer factoring and the elliptic curve discrete logarithm. Given a large, stable enough quantum computer, it could in principle compute a private key directly from a public one. That is a genuine, category-level threat: once a machine is capable enough, the security assumption behind the whole signature scheme stops holding. At that point the scheme is simply bypassed.

Grover's algorithm is the one that comes up around "will mining get broken," but it only speeds up brute-force search, and quadratically, not exponentially. Applied to SHA-256, it cuts effective security from 256 bits to roughly 128. That sounds like losing half the strength, but 128 bits is still an astronomically large margin, and miners can offset even that theoretical dent by raising the difficulty target.

Shor's algorithm goes after the lock itself, the signature scheme; once a machine is capable enough, it can in principle open the lock directly. Grover's algorithm goes after the search space behind mining; at best it discounts how long the search takes. The lock stays intact.

Harvest now, decrypt later: why some risk is being planted today

Even without a signature-breaking quantum machine today, an attacker has another option: record valuable encrypted data or already-exposed public keys now, and compute the private key once a quantum machine matures later. Cryptographers call this store-first, crack-later approach harvest now, decrypt later, and it is the phrase researchers reach for most often when warning against complacency.

Blockchain's particular characteristics make this worth watching. The ledger is public, permanent, and effectively unchangeable. Once a Bitcoin public key is exposed on-chain, that record stays there forever, visible to anyone, and can be archived for later. That differs from an encrypted email sitting on a server for a few years; a public ledger entry can, in theory, be stored and waited on indefinitely.

That said, not all Bitcoin is equally exposed. Many unspent addresses use a format that hashes the public key before turning it into an address, so the funds there correspond to a hash of the key, not the key itself; as long as those funds are never spent, the public key stays hidden behind that hash. Real exposure sits with addresses that have already been spent from once, which reveals the public key on-chain, plus a batch of early Bitcoin holdings that used raw, unhashed public keys as addresses from the start. Ethereum's account model differs: addresses get reused repeatedly, and the first outgoing transaction from one typically exposes its public key, so exposure there works somewhat differently than on Bitcoin.

None of this means your funds are at risk tomorrow. It means whether a public key has ever been exposed is a key variable in judging how exposed a given holding is, and section 8 covers what you can do about it.

How many qubits would it take to break Bitcoin?

Headlines love to say a company just built a chip with some large number of qubits. Almost always, that number refers to physical qubits, the raw, error-prone kind that have not been error-corrected. Running something as demanding as Shor's algorithm reliably requires logical qubits instead: a bundle of many physical qubits working together, correcting each other's errors, to form one dependable unit. The two terms sound similar but differ by an order of magnitude in what they represent.

The published estimates have fallen fast. These are the main ones for the 256-bit elliptic curves used by Bitcoin and Ethereum, with one RSA figure for comparison:

Two things follow. The "millions of qubits" figure still repeated in older coverage is out of date; the 2026 papers bring it down to tens or hundreds of thousands of physical qubits, depending on the hardware. And speed matters as much as size. A machine that needs days per key can only go after coins whose public key has been sitting on the ledger for a long time. Google's paper warns that the first fast machines, the ones that finish in minutes, could also attack a transaction while it waits in the public mempool to be confirmed, because spending reveals the public key.

Nobody can give you the year, and the research papers do not try. What does exist are the defenders' deadlines, which show how seriously the people responsible take it. NIST's draft transition plan, IR 8547 from November 2024, would have US federal systems stop using RSA and elliptic-curve signatures after 2035, with the weaker 112-bit versions deprecated after 2030. Cloudflare said in April 2026 that it aims to be fully post-quantum by 2029, and the Ethereum Foundation's September 2026 priorities target a quantum-resistant Ethereum by December 2029. Anyone quoting a precise "year quantum breaks crypto" with total confidence is more likely marketing something than reporting research.

Post-quantum cryptography: where NIST standards stand

Rather than waiting for an answer to "when will quantum break current encryption," cryptographers started on a backup plan much earlier: a new generation of algorithms that stay hard to break even for a quantum computer. That effort goes by the name post-quantum cryptography, or PQC.

The US National Institute of Standards and Technology (NIST) ran a nearly decade-long, open, global process to solicit and evaluate candidate algorithms, finalizing the first three standards in 2024: FIPS 203 (ML-KEM, derived from Kyber, for key exchange and encryption), FIPS 204 (ML-DSA, derived from Dilithium, for digital signatures), and FIPS 205 (SLH-DSA, derived from SPHINCS+, a backup signature scheme built on different math, kept in reserve in case one approach is ever broken).

These standards are not staying on paper. Internet infrastructure is already rolling them out; a meaningful share of encrypted web connections already use the new key-exchange algorithms, and several countries and large institutions have published migration timelines. Migration at the blockchain protocol layer is further behind and more complicated, since changing a signature algorithm means coordinating an entire network's upgrade and figuring out what happens to old addresses, covered next.

Can Bitcoin and Ethereum upgrade to resist quantum attacks

Yes. Cryptographically, nothing stops Bitcoin or Ethereum from replacing today's ECDSA signatures with a post-quantum scheme. This is not an unsolved technical mystery; having a technical path was never the hard part.

The hard part is coordination. Changing a blockchain's rules requires most of the network, miners or validators, node operators, exchanges, wallet developers, to agree and roll the upgrade out through a soft fork or hard fork. That routinely takes years of debate, testing, and consensus-building, and plenty of past proposals have stalled or been reworked along the way. There is also a thornier question: whether and how old addresses and holdings get migrated to a new signature scheme, itself a governance problem that touches everything downstream.

The two big chains are at different stages. On Bitcoin, BIP-360 was merged into the Bitcoin proposals repository in February 2026 as a draft. Now called Pay-to-Merkle-Root (P2MR), it adds an output type that works like Taproot with the key-path spend removed, so no public key sits exposed in the output. A separate draft, BIP-361, sketches a phased sunset of old signatures that would begin about three years after activation. Neither has been activated or scheduled. On Ethereum, the Foundation formed a Post-Quantum Security team in January 2026, and its September 2026 priorities aim for quantum resistance across execution, consensus and data by December 2029. Neither timetable is a promise, but both can be checked, as the next two sections show.

A timeline with no dates: what has to happen first

People search for a "quantum computing threat to bitcoin timeline" and get confident-sounding years back. There is no honest answer in that form, but the question can be rewritten: before that day arrives, what has to happen, and in what order? The four steps below carry no dates. Each one has an observable signal, which means you can work out for yourself roughly where things stand.

1. Error correction has to hold. Physical qubits fail far too often, so a large number of them are spent producing one usable logical qubit. You will know this step has been passed when vendors and papers start reporting the error rate and lifetime of logical qubits instead of competing on physical qubit counts.
2. Logical qubits have to reach scale. The 2026 estimates put one elliptic-curve key at about 1,200 logical qubits. By September 2026 the best public results were 48 fully error-corrected logical qubits on Quantinuum's Helios and algorithms on up to 96 in QuEra's machines. This step is passed when roadmaps are denominated in logical qubits and two or three consecutive machines actually deliver what the roadmap promised.
3. The machine has to run for a long time without failing. Shor's algorithm does not produce an answer in an instant; it needs a long, uninterrupted computation. The signal here is a factorisation of a meaningful size completed on real hardware, rather than textbook numbers like 15 and 21. The largest elliptic-curve key broken on quantum hardware so far, for Project Eleven's prize in April 2026, was 15 bits long; Bitcoin's are 256.
4. The target has to still be sitting there. The first three steps describe the attacker. This one describes the defence: by the time the hardware arrives, how much value is still secured by the old signature scheme, and how many addresses with exposed public keys were never moved.

Read the four together and what is really running is two clocks: attacker capability on one, migration progress on the other. Which one finishes first decides whether this ends up as an incident or as an unremarkable upgrade. That reframes the question worth caring about. It is not when quantum computers mature, it is whether the things you care about have moved by the time they do. The second question is one you can check today.

Three places you can check the migration yourself

The migration clock from the previous section does not need a news article to read it out to you. All three sources below are public, and going through them takes about a quarter of an hour.

First, the standards themselves. NIST keeps the post-quantum cryptography project on a public page, which makes it a primary source rather than somebody's summary of one.

The page states that the project released its three principal post-quantum standards in 2024, that further standards are still being developed as backups or alternatives, and that organisations should begin migrating now. In the right-hand column, the entries for Migration to PQC and for the Ongoing PQC Standardization Process are where to look when you want to follow what happens next.

Second, your own browser. Web encryption is the layer that has moved fastest, and you can verify it directly. Open the developer tools, find the security or connection panel, and read the key exchange algorithm negotiated for this connection. If a post-quantum algorithm name appears there, usually paired with a classical one in a hybrid form, the connection between you and that site has already been changed over. By Cloudflare's count in April 2026, more than 65% of human traffic to its network was already post-quantum encrypted.

Third, the chain you care about. Look at its public roadmap and proposal archive, and judge it on one thing only: whether the work is scheduled. Someone arguing for post-quantum signatures on a forum and a chain having placed that work in a named release are not the same signal. The first tells you people are thinking about it. Only the second tells you the clock is moving. For Bitcoin, look at the bips repository on GitHub, where BIP-360 and BIP-361 each carry a Status line that still read Draft in September 2026; for Ethereum, the Foundation tracks its post-quantum work at pq.ethereum.org.

Once you have been through all three, your sense of how much time is left rests on what you looked at rather than on the framing of whichever headline reached you first.

What Bitcoin holders should do about quantum risk now

None of this should drive a buy or sell decision. No quantum computer can break a Bitcoin or Ethereum key today, and panic selling costs real money right away.

What you can usefully do depends on where your coins are. If they sit on an exchange, the exchange holds the keys and will have to move them when the network upgrades; your part is the account itself, with a unique password and two-factor authentication. If you hold your own keys, check what kind of address the coins are on. This table follows the exposed output types listed in BIP-360 and in Chaincode Labs' May 2025 report:

Chaincode Labs counted about 6.26 million BTC in outputs with an exposed public key in 2025, about 1.72 million of them in old pay-to-public-key outputs; Project Eleven put the total at roughly 6.9 million in April 2026. Three habits keep your own coins out of that pool. Use a new receiving address for every payment, as bitcoin.org already recommends for privacy. If you have spent from an address and coins remain on it, move them to a fresh one. For coins you plan to leave untouched for years, an address starting with bc1q that has never sent anything keeps the key behind a hash, while a bc1p Taproot address shows it from the first deposit. Each move costs a network fee, so this is housekeeping, not an emergency.

Then watch two things: whether BIP-360 or a successor moves beyond Draft toward activation, and whether your wallet announces support for it. When a quantum-safe address type goes live, the move is a transfer from your old address to a new one inside your own wallet. No legitimate upgrade asks you to send coins to someone else's address, type your seed phrase into a website, or buy a token.

That last point matters because the label is already being used for fraud. The UK's FCA lists a firm called Quantum AI as possibly offering financial services without its permission, Hong Kong's SFC flagged a "Quantum AI" platform for using deepfake videos of Elon Musk, and Australia's ASIC has taken down scam sites trading on the same name. If something like that already has your money, the steps in what to do after sending money to a scam apply. For the separate question of whether USDT and other stablecoins are safe, see what a stablecoin actually is.

One table: common "quantum wrecks Bitcoin" claims, and where they diverge from reality

A condensed version of everything above, so you have something to check the next time a similar headline shows up.

The most common myths about quantum and Bitcoin

A checklist for the next "quantum breaks encryption" headline

You do not need a physics background. Run any such story through these four questions and it becomes fairly easy to tell real research from anxiety-farming content.

• Does it cite logical qubits, or uncorrected physical qubits? The two numbers differ by an order of magnitude; a claim that does not specify which one is a red flag.
• Does it mention error-correction overhead or error rates? Coverage that only brags about qubit counts and skips correction progress is usually thin.
• Is the source a peer-reviewed paper or a recognized institution, or is it a vendor press release or a social media post? The former is far more trustworthy.
• Does it mention progress on post-quantum migration? A responsible threat story usually also covers what the defense side is doing; attack-only framing is a sign of fear-mongering.

Updated: Published July 6, 2026. This first edition covers the difference between Shor's and Grover's algorithms, the qubit scale a real attack would need, where NIST's post-quantum standards stand, and the upgrade paths for Bitcoin and Ethereum. Two sections, a timeline with no dates and three places to check the migration yourself, were added on September 9, 2026. On September 29, 2026 we added the latest qubit estimates for breaking Bitcoin's keys, including 2026 papers from Google and others, today's largest machines for comparison, the NIST, Cloudflare and Ethereum deadlines, the status of Bitcoin's BIP-360, and a table of which address types expose their public key.

Fang Yu · Editor of FutureLens

Fang Yu is the editor of FutureLens, turning published papers, official materials and public explanations into plain-language notes. He is most interested in the gap between a technology's public pitch and the evidence a careful reader can actually check. More about the author