Falling estimates accelerate Bitcoin's quantum countdown

For Bitcoin (BTC) and cryptocurrencies more broadly, the hardware threat from Artificial Intelligence (AI) and quantum computing is now a question of timing, not whether the technology will catch up.

Neither technology can independently break Bitcoin’s cryptography today. Progress in AI-assisted research, however, is giving the quantum computing threat an additional dimension.

Compared with expectations before 2026, AI and quantum computing are narrowing that gap far more rapidly.

For more than a decade, blockchain operated as a trustless ledger regarded as mathematically unbreakable. Underpinning Bitcoin’s security was a problem beyond the capabilities of every classical computer ever built.

Separating a crypto wallet’s public key from its private key is the mathematical challenge known as the Elliptic Curve Discrete Logarithm Problem (ECDLP-256).

Over the last five years, AI advances have threatened to undermine Bitcoin’s underlying security. Even so, this established mathematical problem remains computationally infeasible for classical computers. The difficult question is how much longer that will hold.

6M Bitcoin: Measuring the Exposure

Quantum Alliance estimates that approximately 6.4 million Bitcoin sits in wallets with public keys already exposed on the blockchain. That represents 32.2% of the entire circulating supply. Launched in October 2026, the nine-member coalition includes Satoshi Nakamoto’s 1.1 million BTC in that estimate. A higher total of 6.9 million BTC is cited by the European Supervisory Authorities (ESAs).

With Bitcoin trading near $82,000, these are more than theoretical numbers: upwards of $566 billion remains structurally vulnerable.

Before quantum computing becomes commercially viable, it could undermine some cryptographic networks used to protect transactions, blockchains, databases and communications. That was the warning in a September report published by institutions under the ESAs. According to a CoinDesk article, the report gave no explicit timing for commercial viability.

Quantum Exposure: The Core Risks

Early cryptographic architecture is the source of the quantum risk facing Bitcoin and other cryptocurrencies. Wallets using pay-to-public-key (P2PK) outputs, the default format in Bitcoin’s early days, publish their public keys directly on-chain with each transaction. Address reuse creates the same exposure. Visible public keys become targets. Among them are the keys for the 1.1 million BTC attributed to Satoshi Nakamoto, held in the original P2PK addresses and untouched for more than 15 years.

No immediate danger faces Bitcoin held in P2PK addresses: existing computers cannot solve the ECDLP-256 mathematical problem. The risk lies ahead. Debate focuses on how distant that point is and whether anyone can bring it closer.

The calculation changes with a quantum computer using Shor’s algorithm: it could solve ECDLP-256 exponentially faster than a classical computer.

March saw Google bring forward substantially its preparedness deadline for Q-Day, the point when current quantum computers could solve ECDLP-256 and break public-key cryptography algorithms. Google set its sights on 2029 for readiness and urged others worldwide to begin deploying post-quantum cryptography (PQC) algorithms to reinforce or replace elliptic curves and RSA.

In the post, Google’s VP of security engineering Heather Adkins and senior cryptography engineer Sophie Schmieg said: “As a pioneer in both quantum and PQC, it’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.”

Google’s estimate puts the current requirement for breaking ECDLP-256 at fewer than 500,000 physical qubits, a 20 times downward revision. For comparison, Willow, its most advanced chip, has 105 qubits.

Other organisations share Google’s concern. Earlier in 2026, Oratomic, a startup linked to Caltech, was among those predicting Q-Day could come sooner than previously anticipated.

For Richard Carback, CTO at Postquant Labs and a founding member of the Quantum Alliance, 2028 is a very real possibility for a cryptographically relevant quantum computer. The Vault’s CRO Bryn Bennett offers no specific date, framing the issue instead as an operational challenge rather than a theoretical one.

Speaking at the Quantum Alliance launch in October, Bennett said: “Nobody knows the date, but the estimates keep falling, and the risk is one we can already plan for,” adding, “The question for custodians isn't whether the date is 2028 or 2035; it's whether you can migrate in time if it arrives early.”

Q-Day Timeline: AI Adds Speed

AI’s involvement transforms both the quantum computing landscape and its outlook. Until recently, the prevailing view identified hardware development as the binding constraint: increasing qubit counts requires time, capital and engineering.

That obstacle remains. Independently of progress in quantum hardware, however, AI is reducing the algorithmic cost of attacks and adding another dimension to the threat.

March also brought Eigen Labs’ launch of ECDSA.fail, a platform challenging researchers to devise the most computationally efficient quantum circuit for breaking the cryptography that protects Bitcoin and Ethereum. Within the first eight weeks, over 100 participants had joined, working alongside AI coding agents such as OpenAI’s GPT 5.6 and Anthropic’s Claude Opus 5. Their more than 400 circuit designs cut the spacetime cost by about 86%, taking it from a baseline of 10.75 billion Toffoli-qubits to 1.496 billion.

The researchers said: “Beyond the resulting circuits, ECDSA.Fail provides a case study of Open Autoresearch: a verifier-gated research process in which human participants and AI agents iteratively generate, implement, test, and share candidate improvements against a common measurable objective,”

The race towards Q-Day extends beyond Eigen Labs’ ECDSA.fail to other organisations and open-source communities. Among them is Double AI. Its autonomous AI system WarpSpeed generated a circuit with 2.5 times the spacetime efficiency of Google’s original design.

For Bitcoin, AI’s role in the quantum threat is not a hardware breakthrough, nor does it break cryptography today. Its potential contribution is to lower the hardware threshold for a successful attack.

Rather than developing on separate tracks, AI and quantum computing are converging, with each compounding the threat.

Consensus Missing as Crisis Looms

Among the quantum-risk mitigation measures already being examined by blockchain stakeholders is Bitcoin’s Pay-to-Public-Key-Hash (P2PKH). By hiding a recipient’s public key behind a hash, it offers partial protection, according to Fireblocks.

Stronger cryptographic security ultimately requires a solution to the ECDSA problem. Discussions currently cover several proposed soft fork changes.

Uncertainty over Q-Day’s timing continues to slow post-quantum cryptography migration. The debate spans algorithm selection, governance and the difficulties of upgrading decentralised networks.

Replacing the digital signatures behind every Bitcoin transaction is essential to a successful quantum migration. Developers, miners, wallet providers, exchanges and millions of users would need broad agreement on a new cryptographic standard, alongside a coordinated migration timetable and an approach to dormant coins.

Experts nevertheless believe migration is achievable before quantum computing becomes a threat to Bitcoin and other blockchain protocols. In a recent YouTube video, Bitcoin.com said the industry can expect native post-quantum signature support to be added, weakened primitives to be replaced or reinforced, or consensus mechanisms to be hardened.

Bitcoin Security: The Main Takeaways

Treating the debate as a choice between complete Bitcoin security and an already compromised system misses the point. Both extremes are mistaken and risky. The reality is a more nuanced, often uncomfortable middle ground.

Bitcoin is not being stolen from you now, but there is less room for complacency. The threat from AI and quantum computing is real, credible and well documented. It is not materialising today: no existing computer can break elliptic curve cryptography. Yet Q-Day is approaching faster than anyone expected before 2026.

A structural weakness, rather than a software bug, leaves 6.4 million Bitcoin at risk. The affected wallets have public keys permanently exposed on the blockchain. Those keys provide the data required by a quantum attacker. Migration to a quantum-resistant address format is the only solution, and it should take place before Q-Day.

Distinct though they are, AI and quantum computing compound one another and ultimately present the same problem.

No exact timetable or confirmed date exists for Q-Day. Most organisations, Google included, point to 2028-2031 as the most likely consensus window.

Available solutions remain incomplete.

Governance and consensus present the greater obstacle, harder than the technical threat itself. Migration requires every stakeholder across a global decentralised network to agree on, coordinate and carry out the transition.

Holders need not wait to act: avoiding address reuse prevents the associated exposure of public keys. Move holdings from P2PK outputs into P2PKH, P2WPKH, or Taproot addresses

In short, the quantum threat is genuine. AI’s compounding effect and the unresolved outcome make it more nuanced still.