A late 2026 hardware milestone

Quantum qubits cross the threshold Bitcoin's box cannot ignore

Updated 6 October 2026

That is a measured milestone in late 2026. It is not a broken signature scheme.

What two labs actually reported

In September 2026 two separate teams published hardware numbers that, until that month, had lived only in projection slides. The first was a superconducting array at a US national laboratory that held a logical qubit stable for thousands of surface code cycles, with a physical footprint that finally crossed the threshold the field has used as a proxy for "one logical qubit that stays alive long enough to be useful." The second was a trapped ion group in Europe that demonstrated a magic state distillation routine at a fidelity consistent with running roughly ten thousand Toffoli gates before a correction cycle is needed.

Neither result is a Shor's algorithm run against secp256k1. Neither result is a key extraction. What the two results together do is move the conversation from "how many physical qubits would a fault tolerant machine need" to "how many physical qubits are we already counting in a published, repeatable machine." The honest reading is that the lower bound on resources has dropped, and the upper bound on a credible timeline has tightened by roughly a year.

For a Bitcoin holder this matters in a specific way. The box metaphor on this site treats every unspent transaction output as a closed box with a lock, and the question is always how many boxes could be opened at once by a single capable adversary. A bigger logical qubit count means more boxes can be addressed in parallel, not faster than before. That parallelism is what turns a slow attack into an economical one.

The runway counter on the home page has been ticking against the value held in legacy pay to public key hash outputs. With the September numbers, the gap between the runway and the threshold has narrowed enough that a 2027 or 2028 crossover is no longer the long shot it looked like at the start of 2025.

Why legacy boxes lose the race first

Bitcoin has three rough cohorts of boxes, and only one of them is genuinely exposed to a quantum adversary. Fresh taproot outputs created after the broad adoption of BIP 341 publish a tweaked public key only at spend time. A box that has never been spent still hides its public key behind a hash, and a quantum computer that wants to derive the private key needs the public key to run Shor on in the first place. That is the property called pre image resistance, and it is what keeps the box shut even when the lock is theoretically breakable.

Pay to public key hash outputs created between 2009 and roughly 2011 behave differently. In that era the standard wallet flow hashed the public key for the address but then, on first spend, pushed the raw public key into the witness or scriptSig of the spending transaction. The first time the box opens, the public key is on the chain forever, in the body of an old block, replicated across every full node and every archival service.

A post quantum adversary that breaks secp256k1 does not have to find your keys in real time. The adversary reads the public key out of an old block, runs Shor against the curve offline, and only then constructs a transaction that re opens the same box. Every node that validates the forged signature sees a perfectly legal spend of an old output. The window between "machine is fast enough" and "box is drained" is the time it takes to derive one key per targeted address.

That is why the Satoshi era boxes and the legacy p2pkh cohort are the ones the runway counter watches. The fresh taproot cohort, by contrast, is not exposed until the owner spends and reveals the key, at which point the owner is the one moving coins, not an adversary.

What this changes for a custody stack

There is a temptation, after a news cycle like September 2026, to do something dramatic with the keys. The temptation is wrong. Custody on this site is built around the rule that the air gap, the hardware wallet, the passphrase, the watch only setup, the seedless recovery flow, and the timelock all do specific jobs, and the right response to a new threat is to use the existing jobs, not invent a new one.

The first thing a holder of pre 2011 coins should do is confirm what kind of box they actually hold. If the address starts with a 1 and was funded before April 2011, the public key is almost certainly already on chain, because the early spend pattern pushed it. If the address starts with a 1 and was funded after 2011, there is a fair chance the public key is still hidden, because wallet software began to delay the reveal. A block explorer will tell you which case you are in by checking whether the address appears as a scriptPubKey in any prior spending transaction.

The second thing is to think about destination. Migrating a legacy output to a fresh taproot output does not close the door on the old box, because the old box is still a valid unspent output until a transaction spends it. The migration is the spend. The spend reveals the public key. The reveal puts the key on chain. The box that was theoretically attackable is now practically attackable for the brief window between broadcast and confirmation, and the migration itself becomes the act that exposes the key.

The third thing is to think about timing. A holder who controls the private key for a legacy output and who intends to move the value eventually should think of the next twenty four months as a window in which the move is safer than it will be later, provided the move goes to a destination that does not re expose the key. A holder who does not control the private key, or who holds through a custodian that has not announced a migration plan, is in a more exposed position, because the custodian holds the box and the key.

What the box metaphor still hides

The box metaphor on this site is deliberately flat. Every output is a closed box with a lock, the private key opens the lock, the public key is what a quantum adversary would run Shor on, and the question is always who knows what when. The metaphor does not capture the difference between a box that holds ten dollars of dust and a box that holds a billion dollars of early coin, except by the size of the label on the outside.

What the September 2026 numbers add to the metaphor is the idea of a queue. A fault tolerant machine with a stable logical qubit count can work through a queue of public keys one at a time, and the queue is the set of every public key that has ever been pushed to the chain. The queue is not equally valuable. The early outputs that have never been spent are at the top, because they sit on addresses that almost certainly belong to holders who are not actively watching the chain, and the value is concentrated.

A practical attack is therefore not "break all of Bitcoin." It is "pick the highest value boxes from the queue, derive the keys, and race the legitimate holder to a confirmation." The runway counter tries to put a number on the value of the boxes currently sitting at the top of that queue. The September numbers do not change the composition of the queue. They change the expected speed at which the top of the queue can be drained.

What a holder can and cannot do this month

The honest list of what a holder can do in October 2026 is short. A holder of a fresh taproot output, funded from a hardware wallet, can do nothing and stay roughly where they are. The box is closed, the public key is hidden, and the threat to that box is the threat to a future spend, which the holder controls.

A holder of a legacy output that has already been spent at least once is also in a stable position, because the public key has been on chain for years and either the box has been moved or the holder has accepted the exposure. The interesting cohort is the legacy output that has never been spent, where the public key is on chain and the box is still closed.

For that cohort the options are: leave the box closed and accept the queue position, move the value to a destination that does not re expose the key, or wait for a fork level change that the Bitcoin Core process would have to design, review, and deploy, which is a multi year undertaking on any honest timeline. The BIP 360 proposal is one attempt to formalise a fork level response, and the September numbers add weight to the case for that conversation moving from research to spec.

What a holder cannot do is paste a seed into a watch only field, type a seed into a website to "check quantum safety," or move coins to a new address that a stranger told them is "quantum resistant," because there is no such address in production today. The scams that follow a quantum news cycle are the same scams that follow every other news cycle, with new wording. The rule is the same as it has always been. The seed stays on paper, in a safe, offline, and the watch only field is for the extended public key and the address, never the seed.

Where this leaves the box

The box is still closed. The lock is the same lock it was a year ago, and the curve is the same curve. What changed in September 2026 is the perceived speed of the lockpicker, not the lock. A box that was safe from a lockpicker who would take a decade to pick a single lock is not as safe from a lockpicker who can run a hundred picks in parallel.

For a holder of fresh taproot coins the message is to keep using the hardware wallet, keep using the passphrase, keep the watch only setup separate from the seed, and stop reading the news cycle as if it were a to do list. For a holder of legacy coins the message is to look at the address, check whether the public key is on chain, and decide whether the next twenty four months is a window to use or a window to waste.

The runway counter on the home page will continue to tick. The threshold for a genuinely dangerous machine is still ahead of the published hardware, by a margin that is now measured in months rather than years. That is the only fact that matters for a custody decision, and it is the fact that the rest of the year will slowly sharpen.