Quantum computing vs cryptography in 2026 has become an increasingly important topic for cryptocurrency investors, blockchain developers, cybersecurity professionals, and anyone concerned about the future of digital privacy.
As researchers make progress toward more powerful quantum computers, questions are growing about whether this technology could eventually break the cryptographic systems that protect Bitcoin, Ethereum, online banking, encrypted communications, and sensitive personal information.
Two statements about quantum computers and cryptocurrency are both true, and that is why the topic is so easy to misreport. First, no quantum computer capable of breaking Bitcoin or Ethereum exists today. The Google, Ethereum Foundation and Stanford paper that triggered most of the 2026 headlines says so itself. Second, the estimated size of the machine needed has shrunk sharply. A March 2026 paper put the requirement for breaking the elliptic-curve signatures behind most blockchains at fewer than 500,000 physical qubits under stated assumptions, a drop of roughly twenty times compared with earlier best estimates, according to one analysis of the paper.
Headlines turn that into either “Bitcoin will be cracked in nine minutes” or “quantum is decades away, relax.” Neither is a fair reading. This guide separates what quantum computers can break from what they cannot, lays out what the hardware looks like today against what an attack would need, explains the timeline debate and the standards that already exist, and ends with practical steps for holders, developers and anyone who cares about long-lived encrypted data.
How this guide was researched
We prioritized primary sources: Google Quantum AI’s March 2026 paper with Ethereum Foundation and Stanford authors (posted on the Cryptology ePrint Archive), the Ethereum Foundation’s own post-quantum pages on ethereum.org and pq.ethereum.org, and the standards work of the U.S. National Institute of Standards and Technology (NIST). For the broader synthesis of exposure and timelines we leaned on a June 2026 preprint by Iosif Gershteyn and Jacob Alber titled “Quantum Horizon,” which cites those primary sources.
Three cautions about that preprint. It is not peer reviewed. Its authors disclose that they hold cryptocurrencies, and one runs a subnet on another blockchain. And they disclose that AI tools were used in research and drafting, though they say they reviewed the claims and computations. We therefore use it for synthesis and flag its own estimates as the authors’ estimates, and we cross-checked its key facts against the primary sources where we could. Some other figures, such as the NIST draft timeline details, reached us through secondary sites, and we label them.
Finally, quantum forecasting is genuinely uncertain. Nothing here predicts a date, and nothing here is financial advice.
Quantum Computing vs Cryptography in 2026
What a quantum computer can and cannot break
The most common error in this debate is treating “quantum” as a single threat. Two different quantum algorithms matter, and they affect different parts of cryptography.
Shor’s algorithm breaks public-key cryptography. The digital signatures that authorize a Bitcoin or Ethereum transaction, ECDSA over the secp256k1 curve, rest on the difficulty of the elliptic-curve discrete logarithm problem. Peter Shor’s 1994 algorithm solves that problem efficiently on a large enough, error-corrected quantum computer, which would let an attacker derive a private key from a public key.
The same family of math protects RSA, the Diffie-Hellman and elliptic-curve key exchanges used in much of today’s encrypted web traffic, and Ethereum’s validator signatures, which use a different curve called BLS12-381. The preprint adds a subtle point drawn from the Google paper: BLS12-381 is somewhat harder to break than secp256k1, not easier, because it works with larger numbers.
Grover’s algorithm only weakens guessing. It offers a square-root speedup for brute-force search, which roughly halves the effective bit-strength of a hash function. SHA-256 and the other hash functions used in blockchains drop from 256 to about 128 bits of strength, which remains out of reach.
The preprint calculates that a quantum computer cannot meaningfully out-mine Bitcoin, because the speedup is only quadratic, the per-operation cost on error-corrected hardware is high, the speedup barely parallelizes, and Bitcoin’s difficulty adjustment absorbs whatever edge remains. Its model puts one optimistic quantum miner at about one-tenth of a single modern mining chip.
The practical split. Quantum computers threaten the locks (signatures and key exchange), not the mining or hashing. Symmetric encryption such as AES and hash functions are generally treated as safe with larger key sizes. This is the single most important idea to take away, and it is why the fixes are about swapping signature schemes, not abandoning blockchains.
For the basics of how quantum computers work, check Quantum Computing Explained: What It Means for the Tech Industry.
The 2026 numbers: what an attack needs and what exists
What an attack needs. On March 30, 2026, a team from Google Quantum AI, the Ethereum Foundation and Stanford (Babbush, Zalcman, Gidney, Broughton, Khattar, Neven, Bergamaschi, Drake and Boneh) published new resource estimates for breaking the 256-bit elliptic-curve problem on secp256k1. Its abstract says Shor’s algorithm can run with either at most 1,200 logical qubits and 90 million Toffoli gates, or at most 1,450 logical qubits and 70 million Toffoli gates.
Assuming a superconducting architecture with a physical error rate of 1 in 1,000 and a surface code for error correction, coverage of the paper says this corresponds to fewer than 500,000 physical qubits. Logical qubits are the reliable, error-corrected units a program uses; physical qubits are the noisy hardware units that must be bundled together to make them.
To put the trend in context, the preprint notes that a 2017 estimate for the same curve was about 2,330 logical qubits and 230 billion Toffoli gates, and that a separate 2025 result by Craig Gidney cut the estimated cost of factoring RSA-2048 to under one million noisy qubits running for less than a week, from 20 million qubits in a 2019 estimate. Both reductions came from better algorithms, not better hardware.
What exists. According to the preprint’s survey of 2026 hardware, the best machines have roughly 1,000 to 1,200 physical qubits (IBM’s 1,121-qubit Condor and a 1,180-qubit neutral-atom array from Atom Computing, both announced in 2023), and demonstrated logical-qubit counts are in the tens to about a hundred: Google’s 105-qubit Willow chip operates below the error-correction threshold, Quantinuum’s Helios reached 48 logical qubits on 98 physical, and a Harvard, MIT and QuEra system demonstrated up to 96 logical qubits on 448 atoms.
The preprint estimates the remaining gap at about 400 to 500 times in physical qubits even against the most aggressive 2026 estimate, and far more against conservative ones, and it notes the fault-tolerant hardware stack at that scale does not yet exist.
| Item | What an attack on secp256k1 needs | Best reported hardware, 2026 |
|---|---|---|
| Logical qubits | At most 1,200 to 1,450 (Google, EF and Stanford, March 2026) | Tens up to about 100 (Willow, Helios, QuEra system, as reported by the preprint) |
| Physical qubits | Fewer than 500,000 under stated assumptions; conservative estimates reach hundreds of millions | About 1,000 to 1,200 |
| Toffoli gates | 70 to 90 million | Not applicable (no machine runs this circuit) |
| Status | Estimate, not a built machine | The paper itself says cryptographically relevant quantum computers do not exist today |
How to read this. An estimate shrinking is not a machine being built. Every 2026 reduction lowers the bar but does not build the machine, and the hardware gap remains large. At the same time, the shrinking bar is exactly why security engineers take the issue seriously: it has moved without any hardware change, and the same could happen again.
When? Why experts disagree
No one knows when a cryptographically relevant quantum computer (CRQC) will exist, and honest sources say so. The preprint folds four signals into one Monte Carlo forecast: how fast the resource requirement falls, how fast hardware scales, a lag between raw qubit counts and a working fault-tolerant machine, and expert surveys from the Global Risk Institute.
It finds that two kinds of evidence disagree by more than a decade: expert surveys center around 2038 to 2040, while the bottom-up hardware model centers around 2052. The combined distribution is bimodal, and the authors report cumulative probabilities rather than a single date: about a one-in-six chance of a CRQC by 2035 (8% to 24% depending on how the evidence is weighted), near 30% by 2040, and about 60% by 2050, with an 80% range of roughly 2032 to 2060.
Three caveats from our reading. First, this is one team’s model, blended from two different kinds of evidence, and the authors say the near-term probability tracks the weight they give the expert surveys. Second, the authors say the result is a forecast, not a prediction. Third, even a modest near-term probability is relevant for planning, because migrating cryptography takes years. The decision rule most security researchers use, Mosca’s inequality, says assets are at risk if the time to start migrating plus the time to migrate exceeds the time until a CRQC arrives. The preprint’s model says a prompt start in 2026 would finish migration around 2029 to 2031, ahead of even an optimistic 2035 machine, and that delay, not difficulty, is the main danger.
“Harvest now, decrypt later”: the threat to data
Signatures and encrypted data face different quantum risks, and mixing them up leads to bad advice.
Signatures matter at the moment of use. Forging one requires the quantum computer to exist when the attack happens, so signature risk is about future theft.
Encrypted data can be attacked retroactively. An adversary can record encrypted traffic or stored data today and decrypt it years later once a machine exists. This is called “harvest now, decrypt later,” and it is the reason governments and large organizations are migrating key exchange now even though no machine exists. A 2025 Federal Reserve staff paper examining the risk to distributed ledgers, cited in the preprint, concludes that data already recorded on-chain remains vulnerable. For blockchains the “data” is public keys already exposed on the ledger, a point we return to below.
The practical consequence: the more years your information must stay secret, the more urgent the migration, which is why key exchange has been the first thing deployed in post-quantum form. One recent engineering paper notes that the ML-KEM key-encapsulation standard is now widely deployed in hybrid TLS handshakes alongside classical algorithms, though we did not independently verify deployment levels.
The standards: what NIST has already done
The cryptographic fixes are not hypothetical. NIST finalized its first three post-quantum standards on August 13, 2024:
| Standard | Algorithm | Type | Purpose |
|---|---|---|---|
| FIPS 203 | ML-KEM (derived from CRYSTALS-Kyber) | Lattice-based | Key establishment |
| FIPS 204 | ML-DSA (derived from CRYSTALS-Dilithium) | Lattice-based | Digital signatures |
| FIPS 205 | SLH-DSA (derived from SPHINCS+) | Hash-based | Digital signatures |
A fourth signature standard, FIPS 206 (FN-DSA, based on Falcon), was still in draft as of the sources we saw, and in March 2025 NIST selected a code-based algorithm called HQC as a fifth, backup key-establishment method, with a draft standard expected in 2026 and finalization around 2027, according to secondary sources.
NIST has also proposed a retirement schedule. In its draft report NIST IR 8547, published November 12, 2024, NIST proposes that quantum-vulnerable public-key algorithms at the 112-bit security level, such as RSA-2048, be deprecated after 2030, and that all quantum-vulnerable public-key algorithms be disallowed after 2035.
Secondary sources describe this as still a draft as of mid-2026 and say it already functions as a working baseline for federal procurement and audits; one source also says a June 2026 executive order treats the 2030 date as a compliance deadline for high-value federal systems. We saw that last claim in a single secondary source, so verify it before repeating it.
The catch is size. Post-quantum signatures are much larger than today’s. The preprint notes that a Bitcoin Schnorr signature is about 64 to 72 bytes, while an ML-DSA-44 signature is 2,420 bytes and the largest SLH-DSA variants run to about 49,856 bytes, a 10 to 700 times increase that pressures block space on chains with limited capacity. That is a major reason blockchain designs favor hashing a post-quantum key into an address or using smaller schemes.
Bitcoin: where the exposure is
A Bitcoin coin is exposed to a quantum attacker only if its public key is visible on the blockchain.
The exposure depends on the type of address:
| Script type | What appears on-chain | Public key exposed while unspent? |
|---|---|---|
| P2PK and bare multisig (older formats) | The public key itself | Yes, always |
| P2PKH and P2WPKH (common address types) | A hash of the public key | No, until the first spend; then permanently if the address is reused |
| P2SH and P2WSH | A hash of a script | Only if the script reveals a key |
| P2TR (Taproot) | A raw public key (key path) | Yes |
The behavior that matters most is address reuse. Once an address has spent, its public key is public forever, so any coins later sent to the same address are exposed.
How much is exposed? Glassnode’s May 2026 measurement, cited in the preprint, put quantum-exposed Bitcoin at about 6.04 million coins, roughly 30% of supply, and two other analyses landed in a similar range. The preprint then splits that figure: about 2.3 million BTC (about 12% of supply) it calls irreducibly at risk because they are dormant, lost or from the earliest era and unlikely ever to be moved, and about 3.7 million it calls migratable because their owners could move them to safer outputs if warned. The 2.3 million figure is the preprint authors’ own analysis, so treat it as an estimate. The remaining roughly 65% to 70% sits in fresh, never-reused hashed addresses where the public key appears only at the moment of spending.
The live-attack window. For protected coins, the vulnerable moment is when you spend: the public key is broadcast to the network’s waiting area before a block confirms it. The Google paper distinguishes “fast-clock” machines (such as superconducting qubits) from slower ones, and some coverage reported an attack time of around nine minutes for a prepared fast-clock machine. The preprint’s model estimates that a successful interception of a given spend would be nearer 30% than 41% and only with such a machine, and notes the mitigations are mundane: never reuse addresses, and migrate to quantum-safe outputs as they ship.
Where the fix stands. According to the preprint, BIP-360 (a new output type with hash-based spending paths) was merged into the Bitcoin Improvement Proposals repository in February 2026, but a merge is documentation, not activation. A second proposal, BIP-361, would sunset legacy signatures, which effectively freezes coins that have not migrated, and the preprint says it met a strongly negative reception. That is the governance crux: protecting people who migrate means deciding what to do about coins that never will, including roughly a million presumed-lost early coins, and no prior Bitcoin change has touched the spendability of otherwise valid coins. The binding constraint is social agreement, not cryptography.
Ethereum: broader exposure, clearer fix
Why the exposure is broader. An Ethereum address is derived from a hash of the public key, so an account that has never sent a transaction keeps its key hidden. But the public key can be recovered from any signature, so every account that has ever sent a transaction has an effectively public key, and Ethereum’s account model encourages reuse. The preprint estimates that 50% to 65% of all ETH sits in such accounts.
Be careful with that number: it traces back to a 2021 Deloitte on-chain scan, the Google paper called an aggregate figure very hard to calculate, and the preprint’s authors found no fresh public measurement in June 2026. The Ethereum Foundation’s post-quantum team, as relayed by the preprint, puts the exposed-and-dormant slice at only about 0.1% of supply, far smaller than Bitcoin’s dormant problem.
Validators and data. Ethereum’s proof-of-stake validators sign with BLS signatures, which Shor’s algorithm can also break. The preprint cites the Google paper’s estimate that 20 machines of the secp256k1-breaking class would need more than nine months to forge a two-thirds supermajority, which makes it a slow integrity and finality risk rather than instant theft. The KZG commitments behind “blobs” are also pairing-based and quantum-breakable, but the exposure concerns short-lived data availability, since blobs are pruned after about 18 days, not anyone’s funds.
The fix is already in motion. According to ethereum.org’s page on post-quantum cryptography, the Ethereum Foundation formed a dedicated Post-Quantum Security team in January 2026 and follows a “Lean Ethereum” roadmap that targets 2029 for full post-quantum protection. The plan replaces validator BLS signatures with a hash-based scheme called leanXMSS, uses STARK-based commitments that rely on hash functions rather than elliptic curves, and acknowledges that post-quantum signatures are far larger than BLS ones, which is why a SNARK-based aggregation approach is being developed.
The team’s public hub, pq.ethereum.org, lays out a sequence from post-quantum signature precompiles to post-quantum transactions and aggregation, and a longer-term goal of full post-quantum consensus. A secondary report says the hub launched on March 24, 2026 and that more than ten client teams are running post-quantum test networks.
For user accounts, the preprint points to account abstraction: EIP-7702 and a draft proposal, EIP-8141 (“Frame Transactions,” drafted in January 2026 and under consideration for the Hegotá fork), would let an account adopt a post-quantum signature scheme on its own schedule without changing its address. It also cites Vitalik Buterin’s earlier sketch of a quantum-emergency hard fork in which legitimate owners prove knowledge of a hash-derived seed using a STARK and migrate. These are proposals, not shipped features, and timelines can slip.
The asymmetry. The preprint’s framing is useful: Bitcoin has narrower exposure but a harder migration (because of governance), while Ethereum has broader exposure but a more tractable fix (because each account can upgrade individually). Neither is simply “more at risk.”
Other blockchains
The preprint surveyed the top 20 cryptocurrencies as of mid-2026 and found that none is fully post-quantum on its main signing path; all use elliptic-curve or pairing-based signatures. It scored each from 1 (no post-quantum effort) to 5 (post-quantum live by default). The ratings are the authors’ own judgment, so treat them as one researcher’s snapshot rather than an official ranking:
| Chain | Authors’ summary of post-quantum status (mid-2026) | Their rating |
|---|---|---|
| XRP | ML-DSA on a development network; roadmap to full resistance by 2028 | 4 |
| Solana | Opt-in hash-based “Winternitz Vault” live; Falcon selected but not shipped | 4 |
| Zcash | Dated roadmap: quantum-recoverable wallets in 2026, fully post-quantum in 2027 | 4 |
| BNB Chain and TRON | Test or research stage | 3.5 |
| Ethereum | Most developed roadmap; core post-quantum around 2029 | 3 |
| Bitcoin | BIP-360 merged but not activated | 2 |
| Dogecoin | No post-quantum effort | 1.5 |
Two lessons stand out. First, how a chain hides keys matters as much as which math it uses. Chains where each coin sits in a fresh, hashed, single-use address (Bitcoin, Cardano) or in shielded or stealth designs (Zcash’s shielded pool, Monero) hide the public key until the coin is spent, while account-model chains (Ethereum, Solana, BNB, TRON, XRP) reveal it on the first outgoing transaction.
Second, the engineering is not the obstacle. The preprint notes that the Quantum Resistant Ledger has used the hash-based XMSS scheme as its only signing method since 2018 and that Algorand has run Falcon-based state proofs since 2022, though its consensus still relies on classical signatures. The laggards’ problem is deployment and agreement, not cryptography.
Myths and facts
| Claim you may see | What the evidence says |
|---|---|
| “Quantum computers can break Bitcoin today.” | No. The Google, Ethereum Foundation and Stanford paper itself states that cryptographically relevant quantum computers do not exist today. |
| “Bitcoin will be cracked in nine minutes.” | Misleading. The figure refers to a hypothetical, prepared, fast-clock machine of a size that does not exist, attacking a coin whose public key is exposed during a spend. |
| “Quantum computers will out-mine everyone.” | The preprint’s model says no: the speedup is only quadratic, parallelizes poorly, and difficulty adjustment absorbs it. |
| “Quantum is decades away, so ignore it.” | Overconfident. Resource estimates fell about twentyfold in 2025 and 2026 with no hardware change, and migration takes years. |
| “All your crypto is equally at risk.” | No. Exposure depends on whether your public key is on-chain. Fresh, unspent hashed addresses on Bitcoin are protected until you spend. |
| “Post-quantum math doesn’t exist yet.” | It does. NIST finalized three post-quantum standards in August 2024. The hard part is deployment and agreement. |
| “Hashes and AES are broken by quantum computers.” | No. Grover’s algorithm only halves their effective strength, which remains out of reach. |
| “A ‘quantum-proof’ token will protect me.” | Be skeptical. None of the top 20 coins is fully post-quantum, and “quantum-proof” is a common marketing claim in scams. |
What you can do now
This is educational guidance drawn from the sources above and the preprint’s recommendations, not financial or security advice.
If you hold Bitcoin:
• Do not reuse addresses. Use a wallet that generates a fresh address for each receipt, because spending from an address exposes its public key permanently.
• Understand your address type. Older P2PK outputs and Taproot key-path outputs expose a public key while unspent. Common hashed address types do not until you spend.
• Do not panic-move coins. Moving coins in a hurry carries its own risks, including phishing, and no quantum-safe output type has been activated yet. Wait for your wallet provider to support a migration path and follow its instructions.
• For large transfers, the preprint suggests waiting for confirmations given the spend-time window, a precaution that is cheap if you are not in a hurry.
If you hold Ethereum or tokens on account-based chains:
• Nothing urgent is actionable today, because the migration tools are still being built. Follow the Ethereum Foundation’s pq.ethereum.org for progress and use wallets that publish a post-quantum plan.
• Keep the basics tight. Most real-world losses today come from phishing, bad approvals and key theft, not quantum attacks. See your site’s crypto wallet security guide for those.
For everyone:
• Be skeptical of “quantum-proof” investments, and of anyone urging you to move funds urgently because of quantum news. This is general scam-awareness guidance.
• Keep software updated. Browsers, operating systems and messaging apps are adopting post-quantum key exchange, which protects against harvest-now-decrypt-later.
• Ask about long-lived secrets. If you store information that must stay confidential for 10 to 20 years, ask your providers about their post-quantum plans.
• Keep a calm posture. The preprint’s phrase, prepared urgency rather than alarm, matches the evidence we reviewed.
For developers and organizations
• Take a cryptographic inventory. Find where RSA, ECDSA and ECDH are used, including in libraries, certificates, hardware and third-party services. You cannot migrate what you have not found.
• Build crypto agility. Design systems so algorithms can be swapped without rewriting everything, and consider hybrid key exchange (classical plus post-quantum) during the transition, which NIST’s guidance reportedly endorses.
• Use the draft deadlines as planning anchors. NIST IR 8547 proposes deprecating 112-bit-strength RSA and elliptic-curve algorithms after 2030 and disallowing them after 2035. It is still a draft, so confirm the current status on NIST’s site.
• Smart contract developers: audit assumptions about ECDSA signatures and signature recovery, plan for larger post-quantum signatures and their gas costs, and note that pairing-based commitments (such as KZG) and many SNARK systems are quantum-breakable while STARK-based systems rely on hash functions, which ethereum.org describes as already providing post-quantum security at the application layer.
• Protocol and DAO teams: the preprint argues governance is the binding constraint, so decide the contentious questions (such as dormant coins) early, on a considered timeline, rather than under emergency pressure.
• Track primary sources: NIST’s post-quantum project, the Ethereum Foundation’s pq.ethereum.org, the Bitcoin Improvement Proposals repository and Google Quantum AI’s publications.
For wider context on emerging technology, Check Top 10 Emerging Technologies Revolutionizing the World by 2030 and How AI Enhances Cybersecurity in Web3.
Frequently asked questions
Can quantum computers break Bitcoin today?
No. The best machines have roughly a thousand physical qubits and at most about a hundred logical ones, while breaking the elliptic-curve signatures would need on the order of 1,200 to 1,450 logical qubits. The Google paper says such computers do not exist today.
How many qubits would it take to break Bitcoin’s cryptography?
Google, Ethereum Foundation and Stanford researchers estimated at most 1,200 to 1,450 logical qubits and 70 to 90 million Toffoli gates, which they say corresponds to fewer than 500,000 physical qubits under specific assumptions. Conservative estimates run to hundreds of millions of physical qubits.
When will a cryptographically relevant quantum computer exist?
Nobody knows. One 2026 preprint estimates about a one-in-six chance by 2035, near 30% by 2040 and about 60% by 2050, with expert surveys and hardware models disagreeing by more than a decade. Treat that as scenario analysis, not a prediction.
Is my Bitcoin safe in a wallet I have never spent from?
Coins in a fresh, never-reused hashed address keep their public key hidden until you spend, so they are not exposed at rest. The exposure arises when you spend, and from older address types that reveal the key directly.
Is Ethereum more at risk than Bitcoin?
It is more exposed at rest because any account that has sent a transaction reveals its public key, but the preprint argues it is easier to fix because accounts can adopt new signature schemes individually. Bitcoin has narrower exposure but a harder governance problem.
Will quantum computers destroy Bitcoin mining?
No. According to the preprint’s model, a quantum miner would be far slower than today’s mining hardware, and the speedup parallelizes poorly. The threat is to signatures, not to proof-of-work.
What is post-quantum cryptography?
Cryptography designed to resist both classical and quantum attacks. NIST finalized three standards in August 2024: ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures, with more in progress.
What is “harvest now, decrypt later”?
Recording encrypted data today to decrypt it once a powerful quantum computer exists. It is the main reason key exchange is being upgraded now, and it matters most for information that must stay secret for many years.
What is BIP-360?
A Bitcoin Improvement Proposal for a new output type that includes hash-based spending paths. According to the preprint it was merged into the BIP repository in February 2026, which is documentation rather than activation, so it is not live on the network.
Should I sell my crypto because of quantum computing?
We cannot give investment advice, but the evidence we reviewed does not support panic: no machine exists, the cryptographic fixes are standardized, and the main obstacles are coordination and time. Make decisions based on your own situation and consult a professional.
Are there quantum-proof cryptocurrencies?
Some small projects use hash-based or other post-quantum signatures, such as the Quantum Resistant Ledger since 2018, but none of the top 20 coins by market value is fully post-quantum on its main signing path according to the preprint. Be wary of marketing claims.
The quantum threat to blockchains is real, narrow and manageable, but not distant enough to ignore. It targets signatures, not mining or hashing. No machine capable of an attack exists, and the hardware is a few hundred times short of even the most aggressive 2026 estimate. But those estimates have fallen about twentyfold in two years without any new hardware, expert surveys put meaningful probability on the 2030s, and “harvest now, decrypt later” means some data is already at risk. The cryptographic fixes exist, standardized by NIST and under active development on Ethereum, while Bitcoin’s challenge is mostly about governance.
For individuals, the useful response is calm and specific: avoid address reuse, follow your wallet’s migration guidance, be skeptical of “quantum-proof” pitches, and keep the more immediate risks, such as phishing and approvals, under control. For developers and organizations, it is to inventory cryptography, build agility and start planning toward the NIST dates. Check the sources below, because this field changes quickly and some figures here come from a non-peer-reviewed preprint.
Sources
URLs below were returned during our October 29, 2026 research. Items marked secondary are summaries of primary sources; verify key figures against the primary documents before quoting.
1. Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations. Babbush, Zalcman, Gidney, Broughton, Khattar, Neven, Bergamaschi, Drake and Boneh, Cryptology ePrint Archive 2026/625 (Google Quantum AI, Ethereum Foundation, Stanford). Logical-qubit and Toffoli estimates.
2. Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities (abstract page, submitted March 30, 2026, revised April 15, 2026). AlphaXiv. Fewer than 500,000 physical qubits under stated assumptions (secondary summary of the paper).
3. 9 Minutes to Crack Bitcoin? The Technical Boundaries and Industry Misreading of Google’s Quantum White Paper. Safeheron (secondary analysis; about 20x reduction claim, “what the paper does not prove”).
4. Quantum Horizon: An evaluation of quantum computing as a threat to Bitcoin and Ethereum. Gershteyn and Alber, arXiv 2606.14484, June 2026. Preprint, not peer reviewed; authors disclose holdings and AI-tool use. Exposure estimates, forecast, readiness survey.
5. Post-quantum cryptography on Ethereum. ethereum.org. Post-Quantum Security team formed January 2026; Lean Ethereum targeting 2029; leanXMSS and STARK commitments.
6. Post-Quantum. Ethereum Foundation Post-Quantum team, pq.ethereum.org. Roadmap stages.
7. Ethereum Foundation Sets 2029 Target for L1 Quantum Upgrade. CoinPaprika (secondary; hub launch date March 24, 2026; devnet participation).
8. Vitalik Buterin outlines quantum resistance roadmap for Ethereum. Cointelegraph (secondary).
9. NIST Post-Quantum Cryptography Standardization. Wikipedia (secondary summary of NIST’s August 13, 2024 release of FIPS 203, 204 and 205 and the March 11, 2025 HQC selection; confirm on nist.gov).
10. NIST IR 8547: A Roadmap for Transitioning to Post-Quantum Cryptography. PostQuantum.com (secondary; draft deprecation after 2030 and disallowance after 2035; the claim about a June 2026 executive order appears here only).
11. The Complete US Post-Quantum Cryptography (PQC) Regulatory Framework in 2026. PostQuantum.com (secondary; FIPS 206 and HQC status).
12. NIST IR 8547 Explained: 2030 and 2035 PQC Deadlines. Encryption Consulting (secondary; draft status as of mid-2026).
13. Aquaman: A Transparent Proxy Architecture for Quantum Resilient Key Establishment. arXiv 2605.06932 (research paper; used for hybrid ML-KEM deployment and signature-size context).
14. Works cited in the preprint but not opened by us: Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” arXiv 2505.15917 (); Federal Reserve FEDS 2025-093 on harvest-now-decrypt-later; NIST’s August 2024 announcement.
