Should crypto holders worry about quantum computers? A 2026 field guide
Quantum computing is a real long-term risk to crypto, but it is not an emergency. No quantum computer today can break Bitcoin. Google researchers estimated in March 2026 that breaking Bitcoin's signature curve would take fewer than 500,000 physical qubits running for minutes, and no public machine is close. The real risk is the coins whose public keys are already visible, and the deciding factor is how fast Bitcoin finishes its upgrade.
Published: 2026-10-20 · Last Updated: 2026-10-20
Q-Day is the day a quantum computer can recover a private key from a public key, which breaks the signature schemes most blockchains use today. Bakas Media tracks Q-Day as part of its quantum coverage, because it's the point where AI-era computing first touches money people already hold.
What is Q-Day?
Q-Day is the first day a quantum computer can run Shor's algorithm at a scale that breaks elliptic-curve signatures. Bitcoin uses those signatures (ECDSA and Schnorr on the secp256k1 curve) to prove you own your coins.
Your public key is derived from your private key, and that direction is easy. Going backward is what classical computers can't do in any useful amount of time. A large, error-corrected quantum computer can. Once it exists, anyone holding one could work out the private key behind any public key they can see, and sign transactions as that owner.
Q-Day isn't the same thing as "quantum computers exist". Quantum computers exist now. What doesn't exist yet is one big enough and accurate enough to do this particular job.
When could a quantum computer break Bitcoin?
Nobody knows the date. The estimates keep getting smaller, though:
- May 2025: Craig Gidney of Google Quantum AI estimated that RSA-2048 could be factored in under a week with fewer than a million noisy qubits.
- March 2026: a Google-led team, with Justin Drake and Stanford's Dan Boneh among the authors, estimated that the curve Bitcoin uses can be broken with fewer than 1,200 logical qubits. On superconducting hardware, the paper says that works out to "fewer than half a million physical qubits", running in minutes.
- After that paper, Drake said there is at least a 10% chance a quantum computer recovers a Bitcoin key from an exposed public key by 2032. Drake posted it on X as his own estimate. Google made no such forecast.
The minutes-scale runtime is the part I'd pay attention to. An attack that takes a week can only go after coins that sit still. An attack that takes minutes could, in principle, go after a transaction while it waits to be confirmed.
Which coins are exposed first?
Coins whose public key is already on the chain go first. Glassnode measured this in May 2026:
| Exposure type | BTC | Share of supply | Why it's exposed |
|---|---|---|---|
| Structural | 1.92M | 9.6% | The address type shows the public key by design (early P2PK outputs, bare multisig, Taproot) |
| Operational | 4.12M | 20.6% | Address reuse: the key became visible when coins were spent from the address before |
| Total | 6.04M | 30.2% |
The oldest coins carry the most attention. CoinShares counts about 1.6M BTC in early P2PK outputs, roughly 8% of supply. Owners of old coins can't move to safer addresses if they've lost their keys or are no longer around.
A standard address that has never spent shows only a hash of the public key, which keeps the key hidden until you spend from it.
What is Bitcoin doing about it?
Bitcoin has two draft proposals and a lot of coordinated work. Nothing is activated.
- BIP-360 (Pay-to-Merkle-Root, Draft). A new output type that keeps Taproot-style scripts but removes the spend path a quantum computer could attack.
- BIP-361 (Post-Quantum Migration and Legacy Signature Sunset, Draft). A phased plan. About three years after activation, it would block new sends to legacy address types. Two years after that, it would restrict spends that use the old signatures. No activation date has been set.
- Funding. Galaxy committed up to $5M in developer grants in July 2026. Nine firms, including Strategy, BlackRock, Coinbase and Fidelity Digital Assets, formed a Bitcoin Security Consortium and pledged $15M over three years.
- Open questions. Coinbase, Dan Boneh and Localhost Research ran a post-quantum workshop at Stanford. Coinbase's write-up (September 2026) reported strong interest but "no consensus yet on the exact approach".
The signature schemes themselves exist. NIST finalized its first three post-quantum standards (FIPS 203, 204 and 205) in August 2024. The hard part is choosing one that fits Bitcoin's block space and hardware wallets, and then getting millions of people to move.
Are Ethereum and other chains safer?
Ethereum faces the same math, because its accounts also use secp256k1 signatures. It has a written plan. ethereum.org describes a February 2026 roadmap that targets core post-quantum infrastructure for about 2029, and calls those dates "planning milestones, not guaranteed commitments". Vitalik Buterin also laid out a fallback in 2024: an emergency hard fork that would let users prove ownership with a quantum-safe proof and recover their funds.
| Chain | Signatures today | Post-quantum plan | Status (2026-10-20) |
|---|---|---|---|
| Bitcoin | ECDSA + Schnorr (secp256k1) | BIP-360 output type, BIP-361 migration | Drafts, no activation |
| Ethereum | ECDSA accounts, BLS for validators | Roadmap plus an emergency hard-fork design | Target about 2029, not guaranteed |
| QRL | XMSS, hash-based (RFC 8391) | Post-quantum signatures by design | Live network |
A chain designed around post-quantum signatures, like QRL, avoids the migration problem entirely. A chain with more users and more value has the harder job.
How is AI changing the timeline?
AI is speeding up the slowest part of building a useful quantum computer: correcting its errors. Qubits are noisy. To get one reliable "logical" qubit you need many physical ones plus a decoder that spots and fixes errors faster than they pile up.
In 2024, Google DeepMind and Google Quantum AI published AlphaQubit in Nature. It's a neural-network decoder that made 30% fewer errors than the standard matching method on data from Google's Sycamore processor. Better decoders mean fewer physical qubits per logical qubit, and that's one reason the resource estimates above keep falling.
Nobody has shown that AI alone moved Q-Day closer by a set number of years. It's one input among several, next to better algorithms and better hardware. For an AI operator, though, this is where the two fields stop being separate stories.
What should a holder do now?
Keep doing the basics. Don't panic:
- Stop reusing addresses. Reuse is how 4.12M BTC became exposed. Most modern wallets give you a fresh address each time.
- Keep long-term savings in an address that has never spent. Its public key stays hidden behind a hash until you spend.
- Watch your wallet and custodian. The signal that matters is wallet support for a post-quantum output type once Bitcoin activates one.
- Know your exposure. Older coins in P2PK or reused addresses are the first in line. Plan to move them when a quantum-safe option ships.
Nothing here is investment advice.
Frequently asked questions
Can a quantum computer break Bitcoin today?
No. Google's March 2026 estimate says breaking Bitcoin's signature curve would take fewer than 500,000 physical qubits with low error rates, running for minutes. No public quantum computer is near that scale. The risk is about the future, which is why the upgrade work has already started.
What is Q-Day?
Q-Day is the day a quantum computer can derive a private key from a public key on a widely used curve, such as Bitcoin's secp256k1. After that day, any coin whose public key is visible on the chain could be spent by whoever runs the machine. Nobody has a firm date. Justin Drake, a co-author of Google's 2026 estimate, puts the odds of it happening by 2032 at 10% or more.
Are Bitcoin's oldest coins at risk?
They are among the most exposed, because early P2PK outputs show their public keys. CoinShares counts about 1.6M BTC in that format, roughly 8% of supply. BIP-361 proposes eventually restricting spends that use old signatures, which would effectively freeze unmigrated coins. That idea is debated, and it has not been adopted.
Which blockchains are quantum resistant?
QRL is built on XMSS, a hash-based post-quantum signature scheme. Bitcoin and Ethereum aren't quantum resistant yet. Both have published plans. Bitcoin's are draft proposals (BIP-360 and BIP-361), and Ethereum's roadmap targets about 2029, with no guaranteed date.
Is AI making Q-Day come sooner?
AI is helping. Google DeepMind's AlphaQubit decoder cut error-correction mistakes by 30% versus the standard method in 2024. Better error correction lowers the number of physical qubits needed, which pulls estimates down. It's one factor among several, alongside algorithm and hardware progress.
Should I sell my crypto because of quantum computing?
This guide isn't investment advice. The more useful question is whether a network can upgrade its signatures before a capable quantum computer exists. Track activation of post-quantum proposals and wallet support. Avoid address reuse, and plan to migrate older coins when a safe option ships.
About the Author
Rick Bakas is an AI operator and the publisher of Bakas Media, covering AI, quantum computing and crypto. He built the ABBI conversational AI in 2017 and has worked in tokenized assets since 2021. Rick is also CMO of Longbow, which this article does not cover. Sources are linked inline next to each number.