When Will Quantum Computers Break Bitcoin? The Evidence-Based Timeline

Can a Quantum Computer Break Bitcoin Today?

No. Bitcoin’s signatures rest on the elliptic curve secp256k1, and Shor’s algorithm can recover a private key from its public key only on a large, error-corrected quantum computer. Nothing close to that exists. The two machines usually cited as proof that the threat has arrived show how far there still is to go:

The record for Shor’s algorithm itself is still the number 21, factored in 2012; the largest numbers factored by quantum computers have not grown because the algorithm only works once enough logical qubits exist. That is also why the small records are not reassuring: progress shows up in error correction and in the falling size of the machine needed, not in the size of numbers factored.

How Many Qubits Does It Take to Break Bitcoin?

The requirement has dropped with each new estimate. In 2017 Microsoft researchers put 256-bit elliptic curves at about 2,330 logical qubits. In March 2026 Google Quantum AI published two circuits for 256-bit curves: fewer than 1,200 logical qubits with fewer than 90 million Toffoli gates, or fewer than 1,450 with fewer than 70 million. On a superconducting design with a 0.1% physical error rate, that fits in fewer than 500,000 physical qubits and runs in minutes. In September 2026 IonQ researchers modelled the same attack on a trapped-ion machine: 19,397 physical qubits, about 25.7 days, with an estimated 63% success probability per run.

Those figures are not interchangeable. A smaller physical machine buys its size with a much longer runtime, and that difference decides which coins are at risk, as the sections below explain. We maintain every published estimate, with its assumptions, in how many qubits it takes to break Bitcoin’s secp256k1. For what a logical qubit is and why it costs hundreds of physical ones, see logical versus physical qubits.

Rather have it explained? Watch or listen to our Gemini Notebook overview: When Will Quantum Computers Break ECDSA? (Google sign-in required).

When Will Quantum Computers Be Big Enough?

Several companies now publish dated roadmaps to fault-tolerant machines. Read them as targets, not delivery dates, but they are the best public evidence of when hardware could reach the 1,200 to 1,450 logical-qubit range:

On paper, then, the first machines that could run the attack arrive between 2028 and 2033. Two cautions apply. Roadmaps slip; and a vendor’s logical qubit is not always equivalent to the logical qubit a resource estimate assumes, because error rates and gate speeds differ. The company-by-company detail is in quantum computer roadmaps from 2026 to 2033, and IonQ’s case, where the published estimate and the company’s own 2028 target meet, is in IonQ’s roadmap and Bitcoin.

What Do Experts and Governments Expect?

The longest-running expert survey on the question is the Global Risk Institute’s Quantum Threat Timeline Report. Its edition published on 9 March 2026, by Michele Mosca and Marco Piani, polled 26 experts. They judged a cryptographically relevant quantum computer “quite possible (28-49%) within the next 10 years, and likely (51-70%) in the next 15.”

Industry is planning around the early end of that range. Cloudflare has set 2029 for full post-quantum security, including authentication, and says Google has moved its own migration to 2029; Cloudflare also quotes IBM’s Quantum Safe CTO saying attacks on high-value targets could be possible “as early as 2029.” Coinbase’s independent quantum advisory board, whose April 2026 report judged that at least two more orders of magnitude of progress separate today’s machines from breaking deployed cryptography, still concluded: “Waiting for it to be urgent is not a good idea.”

Governments have written the same expectation into law and guidance. These deadlines are for retiring the elliptic-curve and RSA cryptography that Bitcoin also relies on:

None of these deadlines is a forecast that Bitcoin breaks in a given year. They are the dates by which institutions with the best intelligence have decided they cannot afford to still depend on elliptic curves. The country-by-country rules are in post-quantum cryptography regulations by country, and the private-sector dates in the 2029–2031 migration deadlines.

Which Bitcoins Would a Quantum Computer Steal First?

A quantum attacker needs a public key. Bitcoin addresses built from a hash of the key hide it until the owner spends, so the coins at risk first are those whose keys are already on the blockchain:

• Pay-to-public-key outputs from Bitcoin’s early years, which record the key itself. About 1.7 million BTC sit in them, controlled by about 20,000 keys, many belonging to early miners.
• Повторно використані адреси: once an address has spent once, its key is public for every coin still sent to it.
• Taproot key-path outputs, which place a public key on-chain by design.

Project 11 estimates that about 6.9 million BTC are held in outputs whose public key is already visible, a figure cited by Coinbase’s advisory board in April 2026, which also found that about one million of them sit in just eleven addresses. Those eleven addresses would be the canary: each holds far more than 1,000 BTC, so they are the obvious first targets. The full findings are in the Coinbase quantum advisory board report, and the day that matters for all of this is explained in Q-Day for Bitcoin and crypto.

How Fast Would an Attack Be?

Speed decides who is exposed. The discussion around BIP 360 separates two kinds of attack:

• Long-exposure attacks target keys that have been public for a long time. An attacker can take days or weeks. IonQ’s 25.7-day estimate is fast enough for these, and so is any machine that eventually works.
• Short-exposure attacks target a key revealed by a transaction waiting to be confirmed. The attacker must recover the key and broadcast a competing transaction before the original is mined; Bitcoin’s target block interval is ten minutes, though that is an average, not a guaranteed window. Only a machine running in minutes, like the superconducting design in Google’s estimate, could do this.

So the first quantum computers able to break Bitcoin at all would threaten the 6.9 million long-exposed BTC before they threaten ordinary spending. Faster machines would then put every transaction in flight at risk until the network adopts new signatures. None of this affects mining in the same way: Grover’s algorithm and Bitcoin mining offers only a quadratic speed-up against SHA-256, and our overview of which parts of Bitcoin a quantum computer can attack separates the two threats.

Can Bitcoin Upgrade in Time?

Technically, yes; socially, nobody knows. Two proposals are in the official Bitcoin Improvement Proposals repository, both marked Draft in September 2026:

• BIP 360 proposes Pay-to-Merkle-Root outputs that remove Taproot’s exposed key path, reducing long exposure. It does not add a post-quantum signature by itself.
• BIP 361 describes restricting, and later sunsetting, spends that use legacy ECDSA and Schnorr signatures. It depends on a future proposal that adds post-quantum signatures.

The obstacles are agreement, size and abandoned coins. Post-quantum signatures are larger: Coinbase’s advisers calculate that switching to ML-DSA-44 would cut transactions per block roughly five to seven times once the witness discount is counted. And no upgrade can move coins whose owners have lost their keys, so the network would eventually have to choose between freezing them and letting the first quantum computer take them. The proposals and their dependencies are laid out in BIP 360 and BIP 361 explained, and the argument about what failure would mean in will quantum computing make Bitcoin obsolete.

The Timeline at a Glance

What Should Bitcoin Holders Do Now?

Nothing in this timeline requires panic, and several things are worth doing anyway:

• Never reuse an address. A fresh address per payment keeps your public key hidden until you spend.
• Move coins off reused addresses to new ones before quantum risk is urgent, when it costs only a normal fee.
• Understand what your wallet exposes. Taproot and pay-to-public-key outputs reveal keys on-chain; our guide to whether Bitcoin is quantum safe explains which address types do what.
• Follow BIP 360 and BIP 361. If Bitcoin adopts post-quantum outputs, moving early will be cheaper than moving in a queue.

Disclosure: synxcrypto.com is published by the team that builds SynX. Everything above this note is sourced to the studies listed below; the next paragraph describes our own project.

The alternative is to hold value on a chain that never used elliptic curves. SynX signs every transaction with SPHINCS+-SHAKE-128s, standardised by NIST as SLH-DSA in FIPS 205, whose security rests on hash functions rather than on a discrete-logarithm problem, and uses Kyber-768 (ML-KEM) for key encapsulation. There is no elliptic-curve key for Shor’s algorithm to recover. For how SynX compares with the other chains that make similar claims, see the quantum-resistant cryptocurrencies list.

Sources

• R. Babbush, A. Zalcman, C. Gidney et al., “Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations”, Google Quantum AI, March 2026, revised April 2026.
• T. Häner et al. (IonQ), “Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer”, September 2026.
• M. Roetteler, M. Naehrig, K. Svore and K. Lauter, “Quantum resource estimates for computing elliptic curve discrete logarithms”, 2017.
• M. Mosca and M. Piani, Quantum Threat Timeline Report 2025, Global Risk Institute and evolutionQ, 9 March 2026.
• Coinbase Independent Advisory Board on Quantum Computing and Blockchain, “Quantum Computing and Blockchain”, 21 April 2026.
• B. Westerbaan, “Cloudflare targets 2029 for full post-quantum security”, April 2026; S. Goldberg, on Executive Order 14412, June 2026.
• IBM, “IBM lays out clear path to fault-tolerant quantum computing”, June 2025; IonQ roadmap; Google Quantum AI roadmap; Quantinuum, Helios, November 2025.
• Google, “Meet Willow”, December 2024.
• Bitcoin Improvement Proposals BIP 360 і BIP 361, status checked 23 September 2026.
• Australian Signals Directorate, “Planning for post-quantum cryptography”; European Commission, coordinated implementation roadmap, June 2025; NCSC, migration timelines, March 2025; Canadian Centre for Cyber Security, ITSM.40.001; G7 Cyber Expert Group, financial-sector roadmap, January 2026.