Bitcoin's quantum countdown accelerates as estimates keep falling

For Bitcoin (BTC) and the wider cryptocurrency market, the threat from Artificial Intelligence (AI) and quantum computing now turns on when hardware will catch up, rather than whether it will.

Although neither technology can independently break Bitcoin’s cryptography today, progress in AI-assisted research is bringing another dimension to the quantum computing threat.

Together, however, AI and quantum computing are narrowing that gap more rapidly than anyone had envisaged before 2026.

For over a decade, the blockchain operated as a mathematically unbreakable ledger that required no trust between participants. Underpinning Bitcoin’s security was a problem too complex for any classical computer ever built to solve.

Separating a cryptocurrency wallet’s public key from its private key is a mathematical challenge known as the Elliptic Curve Discrete Logarithm Problem (ECDLP-256).

Admittedly, this long-standing mathematical challenge remains computationally infeasible for classical computers, notwithstanding advances in AI over the last five years that threaten Bitcoin’s underlying security. The uncomfortable question, though, is how long that will remain the case.

6M Bitcoin Sets the Scale of the Risk

Quantum Alliance, a coalition of nine members established in October 2026, puts the Bitcoin held in wallets with public keys already exposed and visible on the blockchain at approximately 6.4 million, or 32.2% of the entire circulating supply. Including Satoshi Nakamoto’s 1.1 million BTC, that total rises to 6.9 million BTC in the estimate from the European Supervisory Authorities (ESAs).

Far from being merely theoretical, these holdings are worth upwards of $566 billion at current market prices near $82,000 per Bitcoin, while retaining a structural vulnerability.

A September report from institutions under the ESAs warned that quantum computing could compromise some cryptographic networks used to protect transactions, blockchains, databases and communications before the technology becomes commercially viable. According to a CoinDesk article, the report gave no explicit indication of when commercial viability might be reached.

Early Wallet Designs Leave Bitcoin Exposed to Quantum Risk

Bitcoin and other cryptocurrencies face a quantum risk rooted in early cryptographic architecture. Wallets with pay-to-public-key (P2PK) outputs, the default format in Bitcoin’s early years, publish their public keys directly on-chain whenever a transaction is made. Wallets that reused addresses are also affected. Public keys become targets once they are visible. Among the affected holdings are the 1.1 million BTC attributed to Satoshi Nakamoto, which remain dormant in the original P2PK addresses after more than 15 years without activity.

It bears repeating that holdings in P2PK addresses are not at immediate risk: no computer currently available can solve the ECDLP-256 mathematical problem. Rather, the dispute concerns how distant this future threat is, and whether anyone can bring it closer.

By contrast, a quantum computer using Shor’s algorithm could solve ECDLP-256 exponentially faster than any classical computer.

March saw Google bring forward considerably its deadline for readiness ahead of Q-Day, the point when current quantum computers could solve ECDLP-256 and defeat public-key cryptography algorithms. Setting its sights on 2029 as the preparation deadline, Google urged others worldwide to follow suit by beginning to implement post-quantum cryptography (PQC) algorithms that supplement or replace elliptic curves and RSA.

In the post, Google’s VP of security engineering Heather Adkins and senior cryptography engineer Sophie Schmieg wrote: “As a pioneer in both quantum and PQC, it’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.”

To put that in perspective, Google argued that breaking ECDLP-256 now requires fewer than 500,000 physical qubits, after revising its estimate down 20 times. Yet Willow, the company’s most advanced chip, has 105 qubits.

Similar expectations extend beyond Google. Earlier in 2026, other organisations, among them Oratomic, a start-up linked to Caltech, forecast that Q-Day could come sooner than previously anticipated.

For Richard Carback, CTO at Postquant Labs and a founding member of the Quantum Alliance, 2028 is a very real prospect for the arrival of a cryptographically relevant quantum computer. The Vault’s CRO, Bryn Bennett, offers no particular date, instead framing the issue in operational rather than theoretical terms.

Speaking at the Quantum Alliance launch in October, Bennett said: “Nobody knows the date, but the estimates keep falling, and the risk is one we can already plan for,” adding, “The question for custodians isn't whether the date is 2028 or 2035; it's whether you can migrate in time if it arrives early.”

AI Brings Q-Day Closer

Adding AI to the equation changes the quantum computing landscape and its outlook substantially. Until recently, the prevailing view held that progress in quantum hardware was the binding constraint: increasing qubit counts requires time, capital and engineering.

That obstacle remains, but AI has added another dimension to the risk by cutting the algorithmic cost of attacks, independently of improvements in quantum hardware.

Eigen Labs launched ECDSA.fail in March to challenge researchers to devise the most computationally efficient quantum circuit for breaking the cryptography that protects Bitcoin and Ethereum. Within the first eight weeks, over 100 participants had joined, working alongside AI coding agents such as OpenAI’s GPT 5.6 and Anthropic’s Claude Opus 5. Their combined submissions exceeded 400 circuit designs. These cut the spacetime cost by about 86%, taking it from a baseline of 10.75 billion Toffoli-qubits to 1.496 billion.

The researchers described the process as follows: “Beyond the resulting circuits, ECDSA.Fail provides a case study of Open Autoresearch: a verifier-gated research process in which human participants and AI agents iteratively generate, implement, test, and share candidate improvements against a common measurable objective,”

The race towards Q-Day also involves organisations and open-source communities outside Eigen Labs’ ECDSA.fail. They include Double AI, whose autonomous AI system WarpSpeed generated a circuit with 2.5 times the spacetime efficiency of Google’s original design.

AI’s contribution to the quantum threat facing Bitcoin is not a hardware development, nor does it break cryptography today. What it may do is reduce the hardware threshold for a successful attack.

Rather than developing along separate paths, AI and quantum computing are reinforcing threats moving rapidly towards convergence.

Quantum Preparations Remain Short of Consensus

Mitigation strategies for quantum computing are already being examined by blockchain stakeholders, including Bitcoin’s Pay-to-Public-Key-Hash (P2PKH). By hiding the recipient’s public key behind a hash, this technology offers partial protection, according to Fireblocks.

Over the longer term, improving cryptographic security requires a solution to the ECDSA problem. Discussions are under way on several proposed soft fork changes.

Nevertheless, uncertainty over Q-Day’s timing continues to slow migration to post-quantum cryptography. The debate encompasses algorithm selection, governance and the difficulties of upgrading decentralised networks.

Replacing the digital signatures behind every Bitcoin transaction is essential to a successful quantum migration. Developers, miners, wallet providers, exchanges and millions of users would need broad agreement on a new cryptographic standard, alongside a coordinated migration timetable and an approach to dormant coins.

Even with these obstacles, experts consider migration achievable before quantum computing threatens Bitcoin and other blockchain protocols in practice. Bitcoin.com said in a recent YouTube video that the industry can expect to introduce native support for post-quantum signatures, replace or bolster weakened primitives, or strengthen consensus mechanisms.

Bitcoin Faces a Credible Future Threat, Not an Immediate Breach

Treating the debate as a binary choice between Bitcoin being entirely safe and already compromised misses the point. Both views are misguided and entail risks. The reality occupies a more nuanced, and often uncomfortable, middle ground.

Bitcoin is not being stolen from you now, but there is less room for complacency. The threat from AI and quantum computing is real, credible and well documented. It is not materialising today, however, because no existing computer can break elliptic curve cryptography. Even so, Q-Day is approaching faster than anyone had anticipated before 2026.

The exposure of 6.4 million Bitcoin represents a structural weakness rather than a software bug. The public keys for these wallets are permanently visible on the blockchain, providing precisely the data that a quantum attacker would require. Moving to a quantum-resistant address format is the only solution, and that migration should take place before Q-Day.

Although AI and quantum computing are distinct threats, their combined effect presents the same problem.

No firm timetable or confirmed date exists for Q-Day. Nevertheless, most organisations, Google among them, identify 2028-2031 as the most likely consensus window.

Available solutions remain incomplete.

Governance and consensus present the greater obstacle, exceeding the difficulty of the technical threat. Migration requires every stakeholder across a global, decentralised network to agree on, coordinate and carry out the transition.

Holders of Bitcoin can act now by refraining from address reuse, which reveals public keys. Move holdings from P2PK outputs into P2PKH, P2WPKH, or Taproot address formats

In short, the quantum threat is real. AI’s reinforcing effect and the unresolved outcome make it a still more nuanced issue.