When Will Quantum Computers Break Bitcoin? The 2029 Timeline

The window opens in 2029 and is wide open by 2033. The mathematics were settled in 1994. Here is the technical timeline, and why the window for migration has already closed.

There is a date circling inside every quantum laboratory, intelligence briefing, and cryptographic research paper on Earth. It is not a secret. It is not classified. It is published, peer-reviewed, and endorsed by the organizations that build the machines and the agencies that will use them.

2029.

That is the year Google's quantum division — the team that built the 53-qubit Sycamore, the team that built Willow — has publicly stated they expect cryptographically relevant quantum computing. Not "someday." Not "eventually." A date on a roadmap backed by billions in hardware investment and a processor that already crossed the fault-tolerance threshold.

2029 is not a deadline. It is the year the window opens. It closes in 2033, when IBM's published roadmap delivers Blue Jay: more than 2,000 logical qubits, comfortably past what it takes to strip a Bitcoin private key out of a public one. Everything between those two dates is the kill zone. A roadmap can slip by a year; a four-year window with two independent vendors inside it does not slip at all.

Bitcoin's entire security model expires somewhere in that window. Not because of a bug. Not because of a hack. Because the mathematics that protect every Bitcoin private key were proven breakable thirty-two years ago, and the only thing standing between that proof and execution is hardware that is being built right now.

The Mathematics Are Not in Dispute

In 1994, Peter Shor published a quantum algorithm that solves the Elliptic Curve Discrete Logarithm Problem (ECDLP) in polynomial time. Bitcoin uses secp256k1 ECDSA, a 256-bit elliptic curve, to sign every transaction. Given a public key Q = kG, Shor's algorithm derives the private scalar k.

Classically, the best attack requires ~2¹²⁸ operations. On a quantum computer, the attack requires approximately 1,200–1,450 logical qubits — and finishes in minutes. That is the March 2026 figure from Google Quantum AI, produced with the Ethereum Foundation and Stanford, and it fits inside fewer than 500,000 physical qubits. An independent Caltech/Oratomic analysis hits the same target on neutral-atom hardware with roughly 26,000 physical qubits over about ten days.

Note what that means before moving on. Every number in this attack got smaller:

• Roetteler et al. (2017): 2,330 logical qubits — the figure the internet still quotes, nine years stale
• Gidney & Ekerå (2021): ~20 million physical qubits, 8 hours, for RSA-2048
• Gidney (2025): the same RSA-2048 target, revised down to under 1 million noisy qubits in under a week — a 20x cut in six years, by the same author
• Google Quantum AI (March 2026): ECDSA-256 at 1,200–1,450 logical / under 500,000 physical, in minutes

The estimates did not converge. They collapsed. Every serious revision has moved the threshold closer, never further, and secp256k1 turned out to be the cheaper, nearer target all along — cheaper than RSA, cheaper than anyone quoting the 2017 paper wants to admit. The debate is over, and it did not end where Bitcoin's defenders assumed.

The 2029 Timeline: Who Said What

In December 2024, Hartmut Neven — founder and head of Google Quantum AI — stated in a Financial Times interview that Google is on track to build a "useful, large-scale quantum computer" by the end of 2029. This was not a hedge. It was a public commitment backed by a processor that had just crossed the fault-tolerance barrier.

This is not a fringe prediction. Every major institution with access to the actual hardware has published a timeline, and they all overlap.

Intelligence agencies do not mandate migration deadlines for threats they consider remote. The NSA published CNSA 2.0 in 2022 and gave every US national security system 13 years to complete the transition. That deadline is 2035. They did not pick that number arbitrarily.

China's quantum budget — publicly reported at over $15 billion — is not a science fair project. The CCP has made quantum computing a cornerstone of its national strategy to dominate cyberspace and advanced technology. This is the same state apparatus that became the world leader in high-speed rail, commercial drones (DJI controls 70%+ of the global market), and 5G infrastructure within a single decade when it decided those sectors were national priorities. The PLA's Strategic Support Force has explicitly integrated quantum computing into military doctrine. When China designates a technology as a strategic priority and backs it with state-directed capital, the track record shows they deliver. If you believe the United States and China are spending tens of billions on hardware that will never work, you have a more creative imagination than the engineers building the machines.

Google Willow: The Threshold That Changed Everything

In late 2024, Google's Willow processor achieved something that most popular coverage failed to appreciate. It crossed the fault-tolerance boundary: the point where adding more physical qubits to a system reduces total error rather than increasing it.

Before this threshold, quantum computers were stuck in a trap: more qubits meant more noise, which meant more errors, which negated the computational advantage. Scaling up was actively counterproductive. Willow proved that the engineering of quantum error correction (QEC) has reached the point where scaling now helps.

This is not an incremental improvement. It is a qualitative phase transition. Before Willow, the question was "can quantum error correction work at scale?" After Willow, the question is "how fast can we scale?"

The answer, based on IBM's trajectory of roughly doubling qubit count every 18–24 months and Google's parallel progress, is: fast enough to reach the ECDLP threshold within this decade.

What Happens to Bitcoin When the Threshold Is Crossed

Per Glassnode, as of May 2026, 6.04 million BTC — 30.2% of the entire supply, roughly $469 billion — already have their public keys sitting on-chain. That is 1.92 million structurally exposed in pay-to-public-key (P2PK) outputs that never hid the key, plus 4.12 million operationally exposed through address reuse. Roughly 1.7 million sit in the earliest P2PK addresses, including Satoshi's estimated 1.1 million BTC. About 2.3 million BTC are irreversibly at risk; the other ~3.7 million could still migrate, if their owners are alive and paying attention.

A CRQC feeds any one of those public keys into Shor's algorithm, outputs the private key, and signs a transfer. No exploit needed. Pure mathematics on publicly available data — nearly a third of all Bitcoin, in the open, waiting.

The dynamic attack is worse, and the March 2026 runtime figure is what makes it real: when any user spends from a P2PKH address, the public key sits exposed in the mempool for ~10 minutes. An attack that takes hours cannot use that window. An attack that takes minutes lives inside it. That means even the disciplined Bitcoiner who never reuses an address is exposed on every spend. And if even a fraction of Satoshi's coins move, it signals secp256k1 is broken — not a dip, but a death spiral.

Why Bitcoin Cannot Migrate in Time

"Bitcoin will just upgrade." Three structural constraints make this fantasy:

1. Governance latency. The SegWit upgrade — far smaller in scope — required 4 years of debate, produced Bitcoin Cash, and nearly fractured the network. Replacing ECDSA across every wallet, node, and hardware signer is orders of magnitude harder. No such proposal exists on Bitcoin Core's roadmap.

2. Signature overhead. SPHINCS+ signatures are 7,856 bytes vs. ECDSA's 72, a 109:1 ratio. Bitcoin's ~7 TPS drops to near-zero without a block size increase, which reignites the same war that produced the 2017 fork.

3. Unmigrateable keys. Satoshi's ~1.1 million BTC cannot be moved. Roughly 2.3 million BTC in total are irreversibly exposed — lost keys, dead owners, abandoned wallets — and no soft fork, hard fork or governance vote can reach a single satoshi of it. These coins remain vulnerable forever. The market impact of millions of stealable BTC is extinction-level for Bitcoin's valuation.

The Clock Is Running

As of March 2026, the timeline looks like this:

The window between "we should start migrating" and "it's too late to migrate" is shorter than Bitcoin's governance model can process a consensus change. This is the fundamental kill condition. Not the qubits. Not the algorithms. The governance latency.

What Quantum Resistance Actually Looks Like

NIST finalized post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM / Kyber) for key encapsulation and FIPS 205 (SLH-DSA / SPHINCS+) for digital signatures. These are the algorithms the US government will use to protect classified data from quantum attack.

Any blockchain deploying these standards from genesis has no migration problem. No exposed legacy keys. No governance battle. No unmigrateable addresses. When Q-Day arrives, chains built on NIST PQC face a day like any other.

The question is no longer "will quantum computers break Bitcoin?" The question is whether you will have moved your wealth to quantum-resistant infrastructure before the announcement. Because by the time the break is public, the private keys will already be extracted. The smart money moves before the obituary is written.

References

• Google Quantum AI, with the Ethereum Foundation and Stanford (March 2026) — ECDSA-256 resource estimate: 1,200–1,450 logical qubits, fewer than 500,000 physical, runtime in minutes. The current benchmark.
• Caltech / Oratomic (2026) — independent neutral-atom analysis: ~26,000 physical qubits over roughly 10 days.
• Gidney (May 2025) — RSA-2048 revised to under 1 million noisy qubits in under one week, down from 20 million qubits and 8 hours in 2019.
• Roetteler et al. (2017) — Quantum resource estimates for 256-bit ECDLP. Quantum Information & Computation. Historical; the ~2,330 logical figure is superseded.
• Gidney & Ekerå (2021) — How to factor 2048-bit RSA in 8 hours using 20 million noisy qubits. Quantum, 5, 433. Superseded by the author's own 2025 revision.
• Webber et al. (2022) — Impact of hardware specifications on reaching quantum advantage. AVS Quantum Science.
• NSA CNSA 2.0 (2022) — Commercial National Security Algorithm Suite 2.0 migration requirements.
• NIST PQC Standardization — FIPS 203 (ML-KEM) and FIPS 205 (SLH-DSA), finalized August 2024.