How close is Bitcoin to being broken by a quantum computer? A March 2026 whitepaper from Google Quantum AI dropped a startling figure: cracking the 256-bit elliptic curve cryptography (ECDSA) protecting each Bitcoin address now requires no more than 1,200 logical qubits—20 times fewer than industry estimates just five years ago. That pushes the quantum countdown to no later than 2033. IonQ targets 1,600 logical qubits by 2028; IBM plans a 2,000-qubit "Blue Jay" system by 2033.
Three threat layers: Harvest Now Decrypt Later, Satoshi's million BTC, live replacement attacks
The danger is already lurking. State-level intelligence agencies may be executing a "Harvest Now, Decrypt Later" (HNDL) strategy—any on-chain private transaction or cross-chain message intercepted now can be cracked once a mature quantum computer exists. The most precise blow will hit old addresses with exposed public keys, chief among them Satoshi Nakamoto's early-mined stash of over a million Bitcoin. Those P2PK-format addresses have had their public keys sitting on-chain for 17 years. Once a cryptographically relevant quantum computer appears, these immobile fortunes become prime targets for hackers. Even scarier is the "instant replacement attack": during the 10-minute wait between broadcasting a transaction and block confirmation, a quantum computer could derive the private key from the broadcast public key and redirect the funds before settlement.
Upgrade pain: throughput halved, fees tripled, with users forced to pay first
Technical solutions already exist—the U.S. National Institute of Standards and Technology finalized post-quantum cryptography (PQC) standards in 2024. But the real bottleneck is: is the Bitcoin network willing to pay the steep price for an upgrade? Research shows anti-quantum signatures produce data hundreds of times larger. A full migration to new standards would slash Bitcoin network throughput by 52% to 57% and jack up fees two to three times. This is a "defensive downgrade": users must immediately absorb higher costs to guard against a threat that hasn't yet materialized.
Physics is not the issue—governance is the hardest problem
Look back at history: the SegWit upgrade, which brought tangible performance gains, still triggered two years of infighting and a network split in the Bitcoin community. Now, pushing an anti-quantum upgrade that would drastically reduce performance (proposals include BIP 360 and BIP 361) in a community deeply averse to central coordination is estimated to take 10 to 15 years to reach consensus—almost exactly overlapping the quantum countdown. By contrast, Ethereum founder Vitalik Buterin has already driven a multi-layered quantum emergency roadmap, even allowing accounts to independently switch to anti-quantum signatures. Experts warn: Bitcoin won't go to zero overnight, but its path to survival is extremely narrow. This race is no longer about quantum computing versus cryptography—it is about whether quantum hardware development can be outpaced by the Bitcoin community's ability to make hard collective decisions under pressure.