The 500,000-Qubit Threshold: How Google's Quantum AI Paper Redefines the Timeline for Breaking Bitcoin

Google's new white paper slashes the physical qubit requirement to crack 256-bit ECC by 20x — placing 6.8 million BTC in a credible, near-term threat window while Bitcoin's governance machinery moves at geological speed.

Executive Summary

• 20x reduction in attack cost: Google Quantum AI's Craig Gidney and Sophie Schmieg demonstrated that breaking 256-bit ECC (the secp256k1 curve underpinning Bitcoin) requires fewer than 500,000 physical qubits — down from the prior community consensus of ~10 million, and from a 2012 baseline of ~1 billion

• Taproot is a liability, not just an asset: The 2021 Taproot upgrade, which expanded Bitcoin's scripting expressiveness, simultaneously enlarged the pool of vulnerable public keys by exposing them at the time of UTXO creation rather than spend, widening the attack surface for quantum adversaries

• 6.8 million BTC ($470B+) sits in quantum-vulnerable addresses as catalogued by Project Eleven's open-source RISQ database — representing roughly one-third of circulating supply, much of it in early P2PK outputs and key-reuse addresses

• The governance gap is the real risk: NIST finalized three post-quantum cryptographic standards in August 2024, BIP 360 merged into Bitcoin's BIP repository on February 11, 2026, yet Bitcoin Core has not begun implementation — and Chaincode Labs estimates a 7-year migration timeline from green light to completion

• A 2029 hard deadline is crystallizing: Google has formally set 2029 as its internal target to complete PQC migration across Android, Google Cloud, and enterprise services — implicitly signaling where the cryptographic industry believes "harvest now, decrypt later" attacks become operationally credible

Background & Market Context

Bitcoin's security rests on two mathematical foundations: SHA-256 for proof-of-work and ECDSA (Elliptic Curve Digital Signature Algorithm) over the secp256k1 curve for transaction authorization. The secp256k1 curve operates in a 256-bit finite field, and the discrete logarithm problem — deriving a private key from a public key — is believed computationally infeasible for classical computers. A modern GPU cluster would require more energy than the sun outputs in its lifetime to brute-force this. The assumption has held for over 15 years.

Peter Shor's 1994 quantum algorithm changes this calculus entirely. Shor's algorithm can solve the elliptic curve discrete logarithm problem in polynomial time on a sufficiently powerful quantum computer, reducing a classically-intractable problem to one that is merely engineering. The critical question has always been: how many physical qubits does that "sufficiently powerful" machine require, and when will one exist? For most of Bitcoin's history, the answer was comfortably far away — billions of qubits, decades of hardware development, a problem for the 2040s. Google's new paper collapses that comfortable distance dramatically.

The white paper, published on arXiv (2505.15917) in May 2025 by Google Research Scientists Craig Gidney and Sophie Schmieg, originally targeted RSA-2048 factorization. Its methodology reduced the qubit requirement for breaking RSA-2048 to under one million physical qubits running for under one week — a 20x improvement over Gidney's own 2019 estimate. When the cryptographic community applied the same techniques to 256-bit ECC in subsequent analysis (formalized in reporting through March 2026), the results were even more alarming: ECC is actually easier to attack than RSA at equivalent classical security levels, requiring 2.6x fewer logical qubits and 148x fewer gate operations.

This matters now because the hardware gap is closing. Google's Willow chip (105 superconducting qubits, December 2024) demonstrated below-threshold error correction — the key prerequisite for fault-tolerant quantum computing at scale. IBM's roadmap targets 4,158-qubit multi-chip systems by 2026. The distance between today's ~1,000-qubit systems and the 500,000-qubit threshold required to threaten Bitcoin remains large, but it is measured in years of engineering progress, not in paradigm shifts. The threat horizon has compressed from "beyond the planning horizon" to "within a single infrastructure investment cycle."

The macroeconomic context amplifies urgency. Bitcoin's total market capitalization exceeded $1.5 trillion in early 2025. The ~6.8 million BTC in quantum-vulnerable addresses — catalogued by Project Eleven — represents not just a store-of-value risk but a systemic shock scenario: a successful quantum attack on even a fraction of those coins would trigger cascading confidence failures across the entire crypto market. This is no longer a theoretical cryptography seminar topic. It is a material risk factor for institutional portfolios.

Key Developments

May 21–23, 2025 — The Gidney-Schmieg Paper Drops Craig Gidney (Google Quantum Research Scientist) and Sophie Schmieg (Senior Staff Cryptography Engineer, Google) submitted arXiv:2505.15917, "How to factor 2048-bit RSA integers with less than a million noisy qubits." The paper introduced four critical technical innovations: approximate residue arithmetic, yoked surface codes for idle qubit storage, magic state cultivation to reduce distillation overhead, and over 100x reduction in Toffoli gate counts versus competing approaches. The result: RSA-2048 breakable with under 1 million physical qubits in under one week — a 20x reduction from the prior best-published estimate and roughly a 1,000x reduction from 2012 baselines. Google's Security Blog published an accompanying explainer the same week at security.googleblog.com.

August 13, 2024 — NIST Finalizes Three Post-Quantum Standards The U.S. National Institute of Standards and Technology released FIPS 203 (ML-KEM, formerly CRYSTALS-KYBER), FIPS 204 (ML-DSA, formerly CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, formerly SPHINCS+). A fourth standard (FN-DSA/FALCON) remained in development. This represented the conclusion of an eight-year standardization process begun in 2016 and gave implementers a stable cryptographic foundation to build on. The mandate accompanying these standards requires U.S. government systems to deprecate quantum-vulnerable algorithms by 2030 and fully disallow them by 2035.

Early 2026 — ECC-Specific Findings Propagate into Crypto Media Following the May 2025 RSA paper, researchers applied Gidney-Schmieg techniques specifically to ECC-256 (secp256k1). The headline finding: breaking Bitcoin's signature scheme requires fewer than 500,000 physical qubits, approximately 1,200–1,450 logical qubits, and 70–90 million Toffoli gate operations. Critically, a successful Shor's algorithm run against a Bitcoin public key takes approximately 9 minutes — beating Bitcoin's 10-minute block confirmation time roughly 41% of the time in statistical modeling. This means real-time mempool interception attacks — stealing a transaction in flight — become theoretically viable with this hardware specification.

February 11, 2026 — BIP 360 Merged into Bitcoin's Official BIP Repository The Bitcoin Improvement Proposal 360, titled "Pay-to-Merkle-Root" (P2MR), authored by Hunter Beast, Ethan Heilman, and Isabel Foxen Duke of BTQ Technologies, was formally accepted into Bitcoin's BIP repository. BIP 360 introduces a new output type that removes Taproot's quantum-vulnerable keypath spend while preserving compatibility with Lightning Network, BitVM, and Ark scripting. The proposal designates ML-DSA (Dilithium) as the primary post-quantum signature scheme. Notably, BIP 360 deliberately increases transaction fees for non-compliant keypath usage as an economic disincentive mechanism.

March 20, 2026 — BTQ Technologies Deploys BIP 360 on Testnet BTQ Technologies announced Bitcoin Quantum Testnet v0.3.0, the first live implementation of BIP 360 on a Bitcoin test network. This marks the transition from theoretical proposal to operational code, though Bitcoin Core has not yet begun integration work and the path to mainnet activation remains uncertain. The testnet deployment demonstrated that P2MR addresses are functional and that Dilithium signatures integrate with Bitcoin's transaction structure without breaking existing UTXO semantics.

March 31, 2026 — CoinDesk Reports on Google's Taproot-Specific Findings CoinDesk published analysis of Google's research specifically addressing Taproot's vulnerability amplification. Unlike traditional P2PKH addresses (which only expose public keys at spend time), Taproot (P2TR) addresses expose the public key at creation time in the UTXO set. This means that for Taproot outputs, an adversary with sufficient quantum capability could attack the key offline without requiring real-time mempool interception — a far less time-pressured and therefore far more tractable attack vector. The irony is profound: Taproot was Bitcoin's most sophisticated recent upgrade, and it inadvertently worsened quantum exposure for every user who adopted it.

Technical Analysis

The Cryptographic Attack Surface: secp256k1 and Shor's Algorithm

Bitcoin's secp256k1 curve defines a 256-bit elliptic curve over a prime field. Each user holds a private key (a 256-bit integer) and a corresponding public key (a point on the curve). The security assumption is that computing the private key from the public key — the elliptic curve discrete logarithm problem (ECDLP) — is computationally infeasible classically. Shor's algorithm solves ECDLP in O((log n)³) quantum gate operations, where n is the field size. For 256-bit ECC, the Gidney-Schmieg optimization reduces this to approximately 1,200 logical qubits executing roughly 80 million Toffoli gate operations, achievable in approximately 9 minutes on hardware meeting the paper's assumptions: 0.1% gate error rates, 1-microsecond surface code cycles, and a nearest-neighbor superconducting qubit grid.

Physical qubit requirements scale from logical qubits through the overhead of quantum error correction. The Gidney-Schmieg paper uses surface codes, which require approximately 100–1,000 physical qubits per logical qubit depending on the target error rate. At 1,200 logical qubits with ~400 physical-per-logical overhead (achievable at 0.1% physical error rates), the result is approximately 480,000 physical qubits — just under 500,000. Three technical innovations specifically drove down this number from prior estimates: (1) Yoked surface codes, which allow idle logical qubits to store magic states more efficiently; (2) Magic state cultivation rather than distillation, reducing the factory overhead that dominated prior estimates; and (3) Approximate residue arithmetic, which allows intermediate computations to tolerate small errors without propagating them.

Why Taproot Worsens the Attack Geometry

Pre-Taproot Bitcoin addresses fall into two security categories. P2PKH (Pay-to-Public-Key-Hash) addresses, used since Bitcoin's launch, store only the hash of the public key on-chain. The actual public key is revealed only when the UTXO is spent. This means an attacker has at most the ~10-minute window between broadcast and confirmation to extract the private key from the public key — a real-time interception attack that (at 500,000 qubits with ~9-minute runtimes) succeeds ~41% of the time. P2PK outputs from Bitcoin's earliest years (associated with Satoshi-era mining) are even more vulnerable because they permanently expose full public keys.

Taproot (P2TR), activated in November 2021 via BIP 341, changed this dynamic. P2TR addresses encode the public key directly in the output's scriptPubKey, visible to the entire network from the moment the UTXO is created. There is no hash-shielding. An adversary with quantum capability can therefore harvest Taproot output public keys from the blockchain and attack them offline, without any time pressure. The attack window is indefinite — days, weeks, months — as long as the UTXO remains unspent. This transforms the quantum threat from a real-time interception problem (hard) into an offline computation problem (much easier, especially as hardware improves). Approximately 1.2 million Bitcoin UTXOs are already in P2TR format as of early 2026.

The "Harvest Now, Decrypt Later" Attack Vector

A sophisticated adversary need not wait until it possesses a 500,000-qubit machine to begin threatening Bitcoin. The "harvest now, decrypt later" (HNDL) strategy involves systematically collecting exposed public keys from the blockchain today and storing them for future decryption. Given that (a) Taproot UTXOs expose public keys indefinitely, (b) all P2PK outputs from early Bitcoin history are permanently exposed, and (c) any address that has sent a transaction has had its public key exposed in the spending transaction, the dataset for a future quantum attack is already publicly available and permanently archived on every Bitcoin full node on the planet. A state-level actor building toward 500,000 qubit capability by, say, 2031 would be rational to harvest all exposed public keys today.

Post-Quantum Signature Schemes: The Replacement Candidates

CRYSTALS-Dilithium (now ML-DSA under FIPS 204) is a lattice-based signature scheme based on the Module Learning With Errors (MLWE) problem. Its security does not rely on either integer factorization or elliptic curve discrete logarithm — the two problems Shor's algorithm attacks. Dilithium produces signatures of approximately 2,420 bytes (Dilithium2) to 4,595 bytes (Dilithium5), compared to Bitcoin's current ECDSA signatures of approximately 72 bytes. This 30–60x signature size increase is the primary practical obstacle to adoption: larger signatures mean higher transaction fees, reduced block throughput, and increased UTXO set pressure. BIP 360 proposes mitigating this through Merkle-tree-based output compression, but the fundamental blockspace cost increase remains.

SPHINCS+ (now SLH-DSA under FIPS 205) is a hash-based alternative that makes minimal security assumptions — only the collision resistance of its underlying hash function. Its signatures are 8,080–50,032 bytes, making it prohibitively expensive for high-frequency Bitcoin transactions. QRL's XMSS (eXtended Merkle Tree Signature Scheme) is also NIST-approved (SP 800-208) but stateful, introducing key management complexities. The industry consensus leans toward Dilithium for Bitcoin's primary signature scheme, with SPHINCS+ as a high-security fallback.

flowchart TD
    A[Google Quantum AI Paper\nMay 2025 - arXiv:2505.15917] --> B{Key Finding}
    B --> C[RSA-2048: <1M qubits\nin under 1 week]
    B --> D[ECC-256: <500K qubits\nin ~9 minutes]
    
    D --> E[secp256k1 Attack Vectors]
    E --> F[Real-Time Mempool\nInterception\n41% success rate\nP2PKH spend window]
    E --> G[Offline Long-Range\nAttack\nTaproot P2TR UTXOs\nno time limit]
    E --> H[Historical P2PK\nOutputs\n1.7M BTC exposed\nSatoshi-era mining]
    
    F --> I[~6.8M BTC Total\nQuantum-Vulnerable\n~$470B+ at risk]
    G --> I
    H --> I
    
    I --> J{Bitcoin's Response}
    J --> K[BIP 360 P2MR\nMerged Feb 11 2026\nML-DSA Dilithium]
    J --> L[BTQ Testnet\nDeployed Mar 20 2026\nv0.3.0]
    J --> M[Bitcoin Core\nNot yet started\nimplementation]
    
    K --> N[Estimated Timeline]
    L --> N
    M --> N
    N --> O[7-10 Year Migration\nper Chaincode Labs]
    
    O --> P{Risk Window}
    P --> Q[2027-2031:\nQuantum hardware\napproaches threshold]
    P --> R[2031-2035:\nPotential credible\nattack capability]
    P --> S[NIST mandate:\n2030 deprecate\n2035 disallow ECDSA]

On-Chain & Market Data

The data presents a stark asymmetry: the quantum hardware capability curve is accelerating (qubit counts growing 4–5x annually, error rates falling, with Google at 105 qubits today and IBM targeting 4,158-qubit systems by end of 2026), while the Bitcoin response curve is effectively flat. The gap between 4,158 qubits (2026 IBM target) and 500,000 (attack threshold) remains substantial — roughly 2 orders of magnitude in qubit count with quality improvements also required. But the trajectory means this gap closes by the late 2020s to early 2030s, precisely the window Chaincode Labs estimates Bitcoin would need to have already completed its migration.

The market has not yet fully priced this risk, which is itself informative. Bitcoin's price performance through early 2026 showed no sustained quantum discount, suggesting either that the market assesses the timeline as beyond a meaningful investment horizon, or that it holds rational expectations that a Bitcoin soft fork will succeed before the threat materializes. The QRL token, which has traded as a direct quantum-threat proxy, saw significant volume spikes on each major Google quantum announcement but has not achieved the sustained market cap growth that would suggest institutional-scale risk positioning against quantum scenarios.

Competitive Landscape

Quantum Resistant Ledger (QRL) is the most operationally mature quantum-safe blockchain, having launched in 2018 with XMSS (eXtended Merkle Tree Signature Scheme) as its native signature algorithm — NIST-approved under SP 800-208. QRL's primary advantage is completeness: it has been quantum-safe by design since genesis, requiring no migration. Its weakness is adoption: QRL remains a niche asset without the network effects, developer ecosystem, or institutional infrastructure of Bitcoin. BlackRock's quantum threat warnings in 2025 drove QRL awareness, but the asset remains below $500M market cap. QRL's long-term thesis depends on Bitcoin either failing to upgrade or taking so long that capital rotates to native quantum-safe alternatives.

Ethereum's Approach: Phased, Vitalik-Guided Ethereum's upgrade cadence — enabled by its PoS social contract and more flexible governance — positions it to respond faster than Bitcoin. Vitalik Buterin has published on quantum migration strategies including account abstraction paths that could enable users to upgrade their key schemes without chain-wide hard forks. The EVM's Turing-completeness allows quantum-safe signature verification to be implemented as smart contract logic before it becomes a protocol primitive. However, the ~37 million ETH in quantum-vulnerable addresses (exposed through contract interactions, validator keys, and EOA transactions) represents a similarly large exposed pool.

Algorand and Solana: Forward-Looking Integrations Algorand has committed to a post-quantum transition roadmap incorporating Falcon (FN-DSA) signatures. Solana's high-throughput design creates a different trade-off: Dilithium's 2,420-byte signatures against Solana's ~65-byte ED25519 signatures would represent a 37x increase in signature data, potentially incompatible with Solana's 65,000 TPS throughput target without significant architectural changes. Both chains benefit from newer, more flexible codebases than Bitcoin but face similar fundamental challenges around migrating existing keys.

SEALSQ and Hardware Security Modules SEALSQ's QS7001 chip represents the hardware security module approach — purpose-built quantum-resistant cryptographic hardware for wallet manufacturers and exchange custody providers. This addresses the new key generation problem but does nothing for the ~6.8 million BTC already in quantum-vulnerable addresses. HSM vendors including Thales and nCipher have begun qualifying post-quantum algorithms under NIST FIPS, targeting enterprise key management systems. This tier of the market moves faster than open blockchain protocols because it does not require protocol-layer consensus.

Stakeholder Analysis

Long-Term Bitcoin Holders (Investors) The population most immediately at risk includes holders of Taproot outputs, early P2PK outputs (associated with Satoshi and early miners), and anyone who has reused Bitcoin addresses. For institutional holders using MPC custody or hardware wallets, the risk is somewhat mitigated if their custody solutions upgrade to quantum-safe key generation before the threat materializes. However, moving funds from a quantum-vulnerable address requires publishing the vulnerable public key in the spending transaction — potentially hazardous in a world where quantum computers are close to the 500,000-qubit threshold. The optimal action is to migrate funds before the quantum threshold is reached, not after.

Bitcoin Core Developers and Protocol Governance Bitcoin Core's conservative governance model — consensus-required, slow-moving, conservative by design — is simultaneously Bitcoin's greatest security strength and its primary liability in responding to quantum risk. The community remains divided: a vocal faction argues that BIP 360 is premature given hardware timelines, while another argues that the 7-10 year migration estimate means work should have already started years ago. The social cost of a hard fork required to implement quantum-safe addresses is enormous in a community where even uncontroversial upgrades take years. There is currently no clear champion within Bitcoin Core driving PQC implementation.

Exchanges and Custodians Centralized exchanges and custodians face a dual burden: migrating their own cold storage keys to post-quantum schemes, and enabling customer withdrawal addresses to be quantum-safe. Coinbase, Kraken, and Binance have begun internal post-quantum migration planning, primarily driven by regulatory pressure (NIST's 2035 mandate covers U.S.-regulated financial institutions). Their operational challenge is communicating to retail customers why they need to move funds to new addresses — a user education problem at scale.

Regulators The NIST mandate creates a clear regulatory signal: ECDSA is deprecated for U.S. government use by 2030 and disallowed by 2035. This creates material compliance risk for any U.S.-regulated entity using Bitcoin-based settlement or custody. The SEC, OCC, and CFTC have not yet issued specific guidance on quantum migration requirements for crypto-native firms, but the direction of travel is clear. Internationally, the EU's NIS2 directive and DORA regulation create similar downstream pressure on European crypto infrastructure providers.

Builders and Protocol Developers (Non-Bitcoin) For EVM-compatible chain developers, the near-term action is implementing Dilithium support at the smart contract layer using existing NIST FIPS 204 implementations, then planning for native protocol integration. The tooling ecosystem (OpenSSL, LibreSSL, Bouncy Castle) has already integrated NIST PQC standards. The primary obstacle for Web3 builders is the lack of well-audited, gas-efficient on-chain implementations of lattice-based verifiers — an active area of ZK-proof and EVM opcode research.

Risk Assessment

1. Quantum Hardware Acceleration (Severity: Catastrophic / Probability: High by 2033) — The primary risk is that quantum hardware timelines compress faster than the published roadmaps suggest, as has occurred consistently over the past five years. Each major milestone (Google Sycamore 2019, Willow 2024) arrived ahead of prior industry consensus. If a state-level actor achieves 500,000 fault-tolerant qubits by 2029–2031, the 7-10 year Bitcoin migration timeline means that a significant fraction of the ~6.8 million vulnerable BTC is compromised before migration completes. The probability of an attack within any given year before 2030 remains low but non-negligible; after 2030 it rises sharply. A successful attack on even 100,000 BTC would cause a market confidence shock far exceeding the direct monetary loss.

2. Bitcoin Governance Paralysis (Severity: High / Probability: Medium-High) — Bitcoin's required consensus model means that any post-quantum upgrade must achieve near-unanimous support among miners, node operators, exchanges, and users. The block size wars of 2015–2017 demonstrated how protocol changes can stall for years even when the technical case is clear. A PQC upgrade is far more complex: it involves new output types, potential hard fork mechanics for migrating old coins, changes to fee economics, and signature size increases that alter the economics for every market participant. If Bitcoin Core does not begin implementation work within the next 12–18 months, the 7-year timeline becomes mathematically incompatible with a pre-threat completion.

3. Harvest Now, Decrypt Later (Severity: High / Probability: Near-Certain) — It is nearly certain that nation-state actors are already archiving quantum-vulnerable Bitcoin public keys for future decryption. This attack requires no current quantum capability — only storage, which is trivially cheap. The 1.7 million BTC in permanently exposed P2PK outputs and all Taproot UTXOs are permanently archived on every Bitcoin full node globally. There is no countermeasure for this attack except migrating the coins to quantum-safe addresses before a capable quantum computer exists. Every day of delay increases the proportion of the ecosystem that has been "harvested."

4. Migration Coordination Failure (Severity: Medium-High / Probability: Medium) — Even if Bitcoin successfully implements quantum-safe address types, the challenge of coordinating migration of ~6.8 million vulnerable BTC is unprecedented. Satoshi's coins (~1.1 million BTC in early P2PK outputs) cannot be migrated without Satoshi's private keys. Lost wallets, deceased holders, custodians who have gone bankrupt — a significant fraction of vulnerable BTC may simply be unmigrated when the threat materializes. The community faces a binary choice: allow vulnerable old coins to be potentially stolen (undermining Bitcoin's property rights premise) or implement some form of time-lock freezing of unmigrated coins (undermining Bitcoin's censorship-resistance premise). Neither option is acceptable to the full Bitcoin community.

Investment & Strategic Implications

For institutional funds with Bitcoin exposure, the Google white paper represents a signal to begin systematic portfolio-level quantum risk assessment. The practical near-term actions are: (1) audit the address types of all custodied Bitcoin — segregating P2PKH, P2PK, P2TR, and multi-sig outputs by quantum vulnerability class; (2) engage custody providers to understand their post-quantum migration roadmaps, particularly their timelines for supporting quantum-safe withdrawal addresses; (3) consider rotating exposure away from the most vulnerable address types (early P2PK, Taproot) toward address types with stronger hash-shielding properties; and (4) monitor BIP 360 progress on Bitcoin Core integration as a leading indicator of whether the protocol will upgrade before the threat materializes. A fund that holds 500,000 BTC in P2PK addresses is holding a different risk profile than one with equivalent BTC in fresh P2PKH addresses.

For protocol builders in the broader Web3 ecosystem, the strategic implication is clear: quantum-safe cryptography should be a first-class consideration in any new protocol design beginning today. The tooling exists — FIPS 203/204/205 are finalized, open-source implementations are production-ready, and NIST has provided a clear standard. The marginal cost of building quantum-resistance into a new protocol at inception is far lower than retrofitting it into an existing deployed network. Projects building new L1s, L2s, or institutional custody infrastructure should treat Dilithium support as a baseline requirement rather than a future roadmap item. The competitive advantage of "quantum-safe by default" will compound as the 2029–2035 threat window approaches.

For Bitcoin-native builders, the most productive near-term contribution is implementation work on BIP 360. The proposal is merged into the BIP repository; the testnet is live. What is missing is a clear champion within Bitcoin Core, a formal activation proposal, and the community consensus process. Builders who want to affect Bitcoin's quantum trajectory should focus on code contributions, documentation, and the economic modeling needed to make the case for BIP 360 activation — specifically, quantifying the fee impact of Dilithium signatures and demonstrating that the blockspace cost is manageable through Merkle aggregation techniques proposed in the P2MR specification.

Outlook: 30 / 180 / 365 Days

• 30 days (through April 2026): Google's publication will drive a wave of Bitcoin developer commentary, likely including new Delving Bitcoin threads on BIP 360 implementation priority. Expect at least one major exchange (likely Coinbase or Kraken) to publish a formal statement on their post-quantum migration timeline within this window, driven by investor relations pressure following CoinDesk coverage. QRL token will see continued volume spikes. No Bitcoin Core implementation work will begin within 30 days — the governance process is too slow.

• 180 days (through September 2026): The critical signal to watch is whether Bitcoin Core formally picks up BIP 360 implementation or whether it stalls at the research/discussion phase. IBM's 4,158-qubit Kookaburra system is expected to be operational by end of 2026; if it demonstrates improved error correction fidelity at that scale, it will materially accelerate the perceived threat timeline and increase pressure on Bitcoin governance. Expect NIST to publish the final HQC standard (draft expected early 2026, final 2027), further expanding the standardized PQC toolkit. A second wave of institutional research reports (following Galaxy's March 2026 paper) will likely push quantum risk into standard due diligence frameworks for crypto asset managers.

• 365 days (through March 2027): By March 2027, the quantum threat will either be on Bitcoin's formal roadmap with an activation proposal in active development, or it will be in active crisis-mode discussion driven by continued hardware advances. The most structurally significant development would be a Bitcoin Core pull request implementing P2MR address type support — even without activation, this would signal that the community has accepted the upgrade is necessary. If no such PR exists by March 2027, the Chaincode Labs 7-year migration estimate implies that Bitcoin cannot complete its quantum transition before 2034 at the earliest, which is inside NIST's 2035 disallowance window and potentially inside a credible attack window if hardware development continues on its current trajectory.

References

1. Gidney, C. & Schmieg, S. (2025). "How to factor 2048 bit RSA integers with less than a million noisy qubits." arXiv:2505.15917. https://arxiv.org/abs/2505.15917

2. Google Online Security Blog. "Tracking the Cost of Quantum Factoring." https://security.googleblog.com/2025/05/tracking-cost-of-quantum-factori.html

3. CoinDesk. "Bitcoin's Taproot could make quantum attacks easier than expected, new Google research says." March 31, 2026. https://www.coindesk.com/markets/2026/03/31/bitcoin-s-taproot-could-make-quantum-attacks-easier-than-expected-new-google-research-says

4. CoinDesk. "Cracking Bitcoin-Like Encryption Through Quantum Computing Could be 20x Easier Than Initially Thought." May 27, 2025. https://www.coindesk.com/tech/2025/05/27/quantum-computing-could-break-bitcoin-like-encryption-far-easier-than-intially-thought-google-researcher-says

5. SpendNode. "Google Says Quantum Could Break Bitcoin With Fewer Qubits Than Expected, and Taproot Is Part of the Problem." https://www.spendnode.io/blog/google-quantum-bitcoin-taproot-500000-qubits-public-key-vulnerability/

6. NIST. "NIST Releases First 3 Finalized Post-Quantum Encryption Standards." August 13, 2024. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

7. NIST CSRC. PQC Standardization Process. https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization

8. BIP 360 Official Site. "Pay-to-Merkle-Root (P2MR)." https://bip360.org/

9. BTQ Technologies. "BTQ Technologies Announces First Deployment of BIP 360 on Bitcoin Quantum Testnet v0.3.0." PR Newswire, March 20, 2026. https://www.prnewswire.com/news-releases/btq-technologies-announces-first-deployment-of-bip-360-on-bitcoin-quantum-testnet-v0-3-0--302718592.html

10. Decrypt. "Google Sets 2029 Deadline to Deal With Quantum Threat — Is It a Problem for Bitcoin?" https://decrypt.co/362356/google-2029-deadline-quantum-threat-problem-bitcoin

11. Project Eleven. Bitcoin RISQ List. https://www.projecteleven.com/bitcoin-risq-list

12. Project Eleven. "Quantum Vulnerability of Bitcoin Addresses." https://blog.projecteleven.com/posts/quantum-vulnerability-of-bitcoin-addresses

13. Chaincode Labs. "Bitcoin and Quantum Computing." https://chaincode.com/bitcoin-post-quantum.pdf

14. QRL Foundation. The Quantum Resistant Ledger. https://www.theqrl.org/

15. PR Newswire. "QRL Emerges as the Post-Quantum Standard as BlackRock Warns of Quantum Threat to Bitcoin and Ethereum." https://www.prnewswire.com/news-releases/qrl-emerges-as-the-post-quantum-standard-as-blackrock-warns-of-quantum-threat-to-bitcoin-and-ethereum-302474671.html

16. Bitcoin Optech. "Quantum Resistance." https://bitcoinops.org/en/topics/quantum-resistance/

17. IACR ePrint. "The Post-Quantum Security of Bitcoin's Taproot as a Commitment Scheme." 2025/1307. https://eprint.iacr.org/2025/1307.pdf

18. Delving Bitcoin. "Changes to BIP-360 — Pay-to-Quantum-Resistant-Hash." https://delvingbitcoin.org/t/changes-to-bip-360-pay-to-quantum-resistant-hash-p2qrh/1811

19. PostQuantum.com. "Bitcoin's Quantum Timeline Is Not RSA's Quantum Timeline." https://postquantum.com/post-quantum/bitcoin-quantum-risk-closer-ecc/

20. Preprints.org. "Hybrid Post-Quantum Signatures for Bitcoin and Ethereum: A Protocol-Level Integration Strategy." September 2025. https://www.preprints.org/manuscript/202509.2079

21. Euronews. "A new era of quantum computing may pose threats closer than we think, Google warns." March 27, 2026. https://www.euronews.com/next/2026/03/27/a-new-era-of-quantum-computing-may-pose-threats-closer-than-we-think-google-warns

22. CoinDesk. "Crypto's quantum threat is real and driving diverging strategies across Bitcoin, Ethereum, Solana." March 28, 2026. https://www.coindesk.com/tech/2026/03/28/here-s-how-bitcoin-ethereum-and-other-networks-are-preparing-for-the-looming-quantum-threat

23. Galaxy Research. "Bitcoin's quantum threat is real, but far from an existential crisis." March 19, 2026. (via CoinDesk) https://www.coindesk.com/tech/2026/03/19/bitcoin-s-quantum-threat-is-real-but-far-from-an-existential-crisis-galaxy-says

24. Safe Edges / Medium. "Google Revealed: Quantum Computers Could Break Bitcoin 20x Easier — A Technical Deep Dive." May 2025. https://safe-edges.medium.com/google-revealed-quantum-computers-could-break-bitcoin-20x-easier-a-technical-deep-dive-710e033b7aa1

25. SEALSQ. "SEALSQ Unveils Quantum-Resistant Cryptography with QS7001 to Secure Bitcoin Wallets Against Quantum Threat." https://www.sealsq.com/investors/news-releases/sealsq-unveils-quantum-resistant-cryptography-with-qs7001-to-secure-bitcoin-wallets-against-quantum-threat