When Will Quantum Computers Break Bitcoin? The 2029 Timeline

Google says 2029. The NSA says 2035. The mathematics were settled in 1994. Here is the technical timeline, and why the window for migration has already closed.

There is a date circling inside every quantum laboratory, intelligence briefing, and cryptographic research paper on Earth. It is not a secret. It is not classified. It is published, peer-reviewed, and endorsed by the organizations that build the machines and the agencies that will use them.

2029.

That is the year Google's quantum division — the team that built Sycamore, the team that built Willow — has publicly stated they expect cryptographically relevant quantum computing. Not "someday." Not "eventually." A date on a roadmap backed by billions in hardware investment and a processor that already crossed the fault-tolerance threshold.

Bitcoin's entire security model expires on that date. Not because of a bug. Not because of a hack. Because the mathematics that protect every Bitcoin private key were proven breakable thirty-two years ago, and the only thing standing between that proof and execution is hardware that is being built right now.

The Mathematics Are Not in Dispute

In 1994, Peter Shor published a quantum algorithm that solves the Elliptic Curve Discrete Logarithm Problem (ECDLP) in polynomial time. Bitcoin uses secp256k1 ECDSA, a 256-bit elliptic curve, to sign every transaction. Given a public key Q = kG, Shor's algorithm derives the private scalar k.

Classically, the best attack requires ~2¹²⁸ operations. On a quantum computer, the attack requires approximately 2,000–2,500 logical qubits and hours of computation. This is not an estimate from a blog post. It comes from peer-reviewed research:

• Roetteler et al. (2017): 2,330 logical qubits for 256-bit ECDLP
• Häner et al. (2020): 2,048–2,500 logical qubits with surface code QEC
• Gidney & Ekerå (2021): ~2,124 logical qubits (RSA-2048; ECC is comparable or cheaper)
• Webber et al. (2022): 2,048 logical qubits → 13–317 million physical qubits depending on architecture

The logical qubit estimates have converged. Five independent research groups, different methodologies, same conclusion: roughly 2,000 error-corrected qubits break secp256k1. The debate is over.

The 2029 Timeline: Who Said What

In December 2024, Hartmut Neven — founder and head of Google Quantum AI — stated in a Financial Times interview that Google is on track to build a "useful, large-scale quantum computer" by the end of 2029. This was not a hedge. It was a public commitment backed by a processor that had just crossed the fault-tolerance barrier.

This is not a fringe prediction. Every major institution with access to the actual hardware has published a timeline, and they all overlap.

Intelligence agencies do not mandate migration deadlines for threats they consider remote. The NSA published CNSA 2.0 in 2022 and gave every US national security system 13 years to complete the transition. That deadline is 2035. They did not pick that number arbitrarily.

China's quantum budget — publicly reported at over $15 billion — is not a science fair project. The CCP has made quantum computing a cornerstone of its national strategy to dominate cyberspace and advanced technology. This is the same state apparatus that became the world leader in high-speed rail, commercial drones (DJI controls 70%+ of the global market), and 5G infrastructure within a single decade when it decided those sectors were national priorities. The PLA's Strategic Support Force has explicitly integrated quantum computing into military doctrine. When China designates a technology as a strategic priority and backs it with state-directed capital, the track record shows they deliver. If you believe the United States and China are spending tens of billions on hardware that will never work, you have a more creative imagination than the engineers building the machines.

Google Willow: The Threshold That Changed Everything

In late 2024, Google's Willow processor achieved something that most popular coverage failed to appreciate. It crossed the fault-tolerance boundary: the point where adding more physical qubits to a system reduces total error rather than increasing it.

Before this threshold, quantum computers were stuck in a trap: more qubits meant more noise, which meant more errors, which negated the computational advantage. Scaling up was actively counterproductive. Willow proved that the engineering of quantum error correction (QEC) has reached the point where scaling now helps.

This is not an incremental improvement. It is a qualitative phase transition. Before Willow, the question was "can quantum error correction work at scale?" After Willow, the question is "how fast can we scale?"

The answer, based on IBM's trajectory of roughly doubling qubit count every 18–24 months and Google's parallel progress, is: fast enough to reach the ECDLP threshold within this decade.

What Happens to Bitcoin When the Threshold Is Crossed

Over 4 million BTC sit in pay-to-public-key (P2PK) addresses where the full secp256k1 public key is already on-chain, including Satoshi's estimated 1.1 million BTC. A CRQC feeds the public key into Shor's algorithm, outputs the private key, and signs a transfer. No exploit needed. Pure mathematics on publicly available data.

The dynamic attack is worse: when any user spends from a P2PKH address, the public key sits exposed in the mempool for ~10 minutes. A sufficiently fast CRQC steals funds in transit. And if even a fraction of Satoshi's coins move, it signals secp256k1 is broken — not a dip, but a death spiral.

Why Bitcoin Cannot Migrate in Time

"Bitcoin will just upgrade." Three structural constraints make this fantasy:

1. Governance latency. The SegWit upgrade — far smaller in scope — required 4 years of debate, produced Bitcoin Cash, and nearly fractured the network. Replacing ECDSA across every wallet, node, and hardware signer is orders of magnitude harder. No such proposal exists on Bitcoin Core's roadmap.

2. Signature overhead. SPHINCS+ signatures are 7,856 bytes vs. ECDSA's 72, a 109:1 ratio. Bitcoin's ~7 TPS drops to near-zero without a block size increase, which reignites the same war that produced the 2017 fork.

3. Unmigrateable keys. Satoshi's ~1.1 million BTC cannot be moved. Millions more sit in dormant wallets with exposed public keys. These coins remain vulnerable forever. The market impact of millions of stealable BTC is extinction-level for Bitcoin's valuation.

The Clock Is Running

As of March 2026, the timeline looks like this:

The window between "we should start migrating" and "it's too late to migrate" is shorter than Bitcoin's governance model can process a consensus change. This is the fundamental kill condition. Not the qubits. Not the algorithms. The governance latency.

What Quantum Resistance Actually Looks Like

NIST finalized post-quantum cryptography standards in August 2024: FIPS 203 (ML-KEM / Kyber) for key encapsulation and FIPS 205 (SLH-DSA / SPHINCS+) for digital signatures. These are the algorithms the US government will use to protect classified data from quantum attack.

Any blockchain deploying these standards from genesis has no migration problem. No exposed legacy keys. No governance battle. No unmigrateable addresses. When Q-Day arrives, chains built on NIST PQC face a day like any other.

The question is no longer "will quantum computers break Bitcoin?" The question is whether you will have moved your wealth to quantum-resistant infrastructure before the announcement. Because by the time the break is public, the private keys will already be extracted. The smart money moves before the obituary is written.

References

• Roetteler et al. (2017) — Quantum resource estimates for 256-bit ECDLP. Quantum Information & Computation.
• Gidney & Ekerå (2021) — How to factor 2048-bit RSA in 8 hours using 20 million noisy qubits. Quantum, 5, 433.
• Webber et al. (2022) — Impact of hardware specifications on reaching quantum advantage. AVS Quantum Science.
• NSA CNSA 2.0 (2022) — Commercial National Security Algorithm Suite 2.0 migration requirements.
• NIST PQC Standardization — FIPS 203 (ML-KEM) and FIPS 205 (SLH-DSA), finalized August 2024.