How Many Qubits Are Needed to Break Bitcoin? A Technical Analysis

A survey of the qubit estimates, the hardware trajectory, and what an order-of-magnitude collapse in the numbers means for ECDSA-secured blockchains.

Bitcoin's entire security model rests on one assumption: that breaking secp256k1 ECDSA is computationally impossible.

That assumption is about to die.

Peter Shor proved it in 1994. A sufficiently powerful quantum computer running his algorithm can derive a private key from a public key in minutes — not years, not decades, minutes. The only remaining question is how many qubits that computer will need. The literature has an answer, it has been revised downward every single time it was revisited, and it is now far closer than any Bitcoin holder wants to believe.

secp256k1 and the Discrete Logarithm Problem

Every Bitcoin transaction is authenticated with ECDSA on the secp256k1 curve, a 256-bit elliptic curve specified in SEC 2 and adopted by Satoshi Nakamoto in 2009. The security of this scheme rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP): given a public key Q = kG, find the scalar k.

Classically, the best known attack (Pollard's rho) requires ~2¹²⁸ operations. At a trillion operations per second, that would take longer than the age of the universe. The problem is genuinely hard for classical machines.

It is not hard for quantum machines. In 1994, Peter Shor published a quantum algorithm that solves the discrete logarithm problem in polynomial time, reducing what takes classical computers billions of years to a computation measurable in minutes. The algorithm exploits quantum superposition to evaluate exponentially many candidates in parallel, then uses quantum Fourier transforms to extract the period, which yields the private key.

ECDSA on secp256k1 falls squarely within the problem class Shor's algorithm was designed for. This is not a conjecture. It is a mathematical proof, published thirty-two years ago, and never refuted.

Logical vs. Physical Qubits: Why the Estimates Diverge

The confusion in popular coverage stems from conflating two fundamentally different metrics. Logical qubits are the error-corrected, mathematically perfect units that Shor's algorithm requires. Physical qubits are the noisy, error-prone hardware elements that must be grouped and error-corrected to produce each logical qubit.

The literature on the ECDLP qubit cost, newest first. Watch the direction of travel:

Read the table top to bottom and the story writes itself. The logical qubit requirement did not hold at 2,000–2,500. It fell to 1,200–1,450. The physical overhead did not hold at 20 million, or at 317 million. It fell to under 500,000 — and on neutral-atom hardware, to roughly 26,000. The attack runtime did not hold at hours. It fell to minutes.

This is what happens when better circuits meet better error correction. Every estimate the industry published was an upper bound written by people discovering, each year, that they had been too pessimistic. Bitcoin's defenders quote the 2017 number. Google published the 2026 one.

The Conflict of Interest Problem

It is worth noting who profits from framing these numbers in a particular direction.

Bitcoin maximalists and large institutional holders like MicroStrategy and Marathon Digital, with billions in BTC exposure, have an obvious motive to characterize the quantum threat as distant or exaggerated. This is not speculation about intent; it is an observation about incentive structures. The same dynamic has played out in other industries: tobacco companies funded decades of contrarian research on smoking, and fossil fuel companies funded doubt about climate models. Financial exposure produces motivated reasoning.

Notice which numbers those interests keep repeating. The comfortable ones. The nine-year-old ones. Roetteler's 2,330 logical qubits, paired with a generous 2,000:1 error-correction ratio, produces a reassuring headline of "millions of physical qubits, decades away." It is arithmetic performed on a superseded input.

The current input is 1,200–1,450 logical qubits inside fewer than 500,000 physical ones, in minutes (Google Quantum AI, March 2026). IBM's published roadmap puts Starling at roughly 200 logical qubits in 2029 and Blue Jay at more than 2,000 logical qubits on about 100,000 physical qubits in 2033 — straight through the requirement, with room to spare. Google's Hartmut Neven has publicly stated that his team expects cryptographically relevant quantum computing by 2029. The gap between current hardware and the threat threshold is measured in years, not generations — and it is being closed from both ends at once, because the target is moving down while the hardware moves up.

Current Hardware: 2026 Snapshot

No quantum computer in existence can break secp256k1. The best publicly known machines sit at roughly 2,500 physical qubits, and not one of them is fault-tolerant at scale. The threat model is prospective, not immediate. But the trajectory matters more than the current snapshot — and the finish line just moved several hundred thousand qubits closer.

Two data points merit attention. First, IBM has roughly doubled its qubit count three times in four years, and its roadmap is public. Second, Google's 105-qubit Willow processor, in December 2024, crossed the fault-tolerance boundary: the point where adding more physical qubits reduces total system error rather than increasing it. It settled a benchmark in under five minutes that would take a classical supercomputer on the order of 10²⁵ years. This is a qualitative threshold, not an incremental improvement. It means that scaling up now helps rather than hurts, which is precisely why the error-correction overhead in the table above collapsed the way it did.

The NSA's CNSA 2.0 advisory, published in 2022, mandates that all US national security systems complete migration to post-quantum cryptography by 2035. Intelligence agencies do not publish migration deadlines for threats they consider remote.

The Exposure Surface: 6.04 Million BTC

The qubit count is one half of the risk equation. The other is how much Bitcoin is already cryptographically exposed. That number has moved too — in the wrong direction for Bitcoin.

Per Glassnode, as of May 2026, 6.04 million BTC — 30.2% of the entire supply, roughly $469 billion — already have their public keys visible on-chain. The split is instructive: 1.92 million BTC are structurally exposed in pay-to-public-key (P2PK) outputs that never hid the key in the first place, and 4.12 million BTC are operationally exposed through address reuse, where the key becomes public the moment the owner spends. Roughly 1.7 million BTC sit in early P2PK addresses, including the ~1.1 million attributed to Satoshi Nakamoto. Of the total, about 2.3 million BTC are irreversibly at risk; the remaining ~3.7 million could still migrate, if their owners are alive, paying attention, and willing.

These keys are not hashed. They sit in the UTXO set as raw compressed public keys, readable by anyone with a full node and an internet connection.

A CRQC with 1,200–1,450 logical qubits could derive the corresponding private key from any of them using Shor's algorithm. No exploit. No vulnerability discovery. No zero-day. Straightforward computation on publicly available data — nearly a third of all Bitcoin sitting in the open with the answer key printed on the front.

There is also a dynamic exposure window, and this is where the March 2026 runtime figure stops being academic. When anyone spends from a standard P2PKH address, the public key is broadcast to the mempool and remains visible for an average of 10 minutes before block confirmation. An attack that takes hours cannot exploit that window. An attack that takes minutes can. Google's estimate does not merely move the date forward — it converts a static-honeypot problem into a live-transaction problem, which means even a perfectly hygienic Bitcoin user who never reuses an address is exposed every time they move a coin.

Harvest Now, Decrypt Later

The HNDL threat model does not require a CRQC to exist today. It requires only that an adversary believes one will exist within the useful lifetime of the data being collected.

Bitcoin's entire transaction history is public. Every public key ever exposed — through P2PK addresses, spent P2PKH outputs, or multisig scripts — is permanently recorded and freely downloadable. An adversary with a long time horizon can harvest this data now and decrypt it when quantum hardware matures. The cost of storage is trivial relative to the value of the keys.

This is not a theoretical exercise. The NSA's CNSA 2.0 advisory and NIST's 8-year PQC standardization effort both exist because the US government considers HNDL a credible, active threat against classical cryptography. Blockchain data, being immutable and public by design, is uniquely vulnerable to this attack class.

The Migration Problem

The standard rebuttal is that Bitcoin will upgrade to post-quantum signatures when the threat materializes. Three structural constraints make this significantly harder than it appears.

Governance latency. Bitcoin's consensus model optimizes for stability, not speed. The SegWit upgrade — which modified transaction serialization without changing the signature scheme — required 4 years of debate, produced a competing fork (Bitcoin Cash), and nearly fractured the network permanently. A post-quantum migration would require replacing ECDSA for every wallet on the network and is orders of magnitude more invasive. No such proposal exists on Bitcoin Core's development roadmap as of March 2026.

Signature overhead. SPHINCS+ signatures (NIST FIPS 205) are 7,856 bytes. Bitcoin's current ECDSA signatures are 72 bytes, a 109:1 ratio. Bitcoin's 1 MB base block size already constrains throughput to approximately 7 transactions per second. Accommodating post-quantum signatures without fundamental architectural changes would reduce that to near-zero. Increasing the block size to compensate would reignite the same governance battle that produced the 2017 fork wars.

Unmigrateable keys. Satoshi Nakamoto's estimated 1.1 million BTC cannot be moved because the keys are presumed lost. The same applies to several million additional BTC in dormant wallets with exposed public keys. These coins cannot participate in any signature-scheme migration and would remain vulnerable indefinitely, regardless of what active wallets do. The market implications of millions of BTC becoming simultaneously stealable are difficult to overstate.

Post-Quantum Cryptography: The NIST Standards

NIST finalized the first post-quantum cryptography standards in August 2024, concluding an 8-year evaluation that involved hundreds of cryptographers and dozens of candidate algorithms. The result is two primary standards relevant to blockchain security:

• FIPS 203 — ML-KEM (Kyber): A lattice-based key encapsulation mechanism. Its security rests on the hardness of the Module Learning With Errors problem, which is resistant to both Shor's and Grover's algorithms.
• FIPS 205 — SLH-DSA (SPHINCS+): A stateless hash-based digital signature scheme. Its security depends solely on the collision resistance of hash functions, a problem class with no known quantum speedup beyond the quadratic advantage of Grover's algorithm, which is easily countered by increasing hash output length.

These standards exist because the cryptographic community reached consensus that the quantum threat to classical public-key cryptography is not a matter of if but when. The relevant question for any system relying on ECDSA, RSA, or EdDSA is whether it can migrate to these standards before a CRQC is operational.

For blockchains, this creates a hard distinction: chains that must migrate (every chain using ECDSA or EdDSA today) and chains that deployed PQC from genesis and face no migration at all.

Timeline Estimates

The published roadmaps converge on a single window: 2029 to 2033.

• 2026–2028: Machines in the low thousands of physical qubits, none fault-tolerant at scale. Insufficient for secp256k1 — but this is the harvesting phase, and the chain history being harvested is already public and permanent.
• 2029 — the window opens: IBM ships Starling, roughly 200 logical qubits. Google has publicly targeted a useful, error-corrected machine in the same year. Neither is enough on its own. Both establish that error-corrected logical qubits have become an engineering deliverable with a delivery date rather than a research question.
• 2033 — the window closes: IBM's Blue Jay: more than 2,000 logical qubits on roughly 100,000 physical ones. That is past the 1,200–1,450 requirement with margin to spare. Somewhere between these two dates, ECDSA-256 stops being cryptography and becomes a formality.

The NSA's CNSA 2.0 deadlines — 2030 for browsers and firmware, 2033 for network equipment and operating systems, 2035 for everything else — sit deliberately across and beyond that window. Nobody writes a compliance schedule that expensive for a threat they expect to miss.

These are not fringe predictions. They are vendor roadmaps and government mandates from IBM, Google, NIST and the NSA — organizations with no commercial interest in overstating the threat, and every commercial interest in understating it.

References

• Google Quantum AI, with the Ethereum Foundation and Stanford (March 2026) — resource estimate for breaking ECDSA-256: 1,200–1,450 logical qubits, fewer than 500,000 physical qubits, runtime in minutes. The current benchmark; supersedes everything below.
• Caltech / Oratomic (2026) — independent neutral-atom analysis: ~26,000 physical qubits against secp256k1 over roughly 10 days.
• Roetteler, M., Naehrig, M., Svore, K.M., & Lauter, K. (2017) — "Quantum resource estimates for computing elliptic curve discrete logarithms." Quantum Information & Computation, 17(15-16). Historical; the ~2,330 logical figure is superseded.
• Gidney, C. & Ekerå, M. (2021) — "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits." Quantum, 5, 433.
• Webber, M. et al. (2022) — "The impact of hardware specifications on reaching quantum advantage in the fault tolerant regime." AVS Quantum Science, 4(1).
• NIST Post-Quantum Cryptography Standardization — FIPS 203 (ML-KEM) and FIPS 205 (SLH-DSA), finalized August 2024.
• NSA Cybersecurity Advisory: CNSA 2.0 — Commercial National Security Algorithm Suite 2.0 migration requirements.
• SEC 2: Recommended Elliptic Curve Domain Parameters — secp256k1 specification used by Bitcoin.

The current benchmark is clear, and it is not the one the internet keeps repeating: between 1,200 and 1,450 logical qubits — inside fewer than 500,000 physical ones, in minutes — are sufficient to break secp256k1 (Google Quantum AI, March 2026). Every major government and technology lab on Earth is racing toward that threshold, and the threshold keeps walking back to meet them. The only two types of blockchains that will exist after the arrival of cryptographically relevant quantum computers are those that were built post-quantum from day one — and those that were not.

There will be no migration window. There will be no soft landing. There will only be chains that prepared, and chains that didn't.