Custody, on a budget

Qubit budget puts post quantum Bitcoin on the clock

Updated 18 October 2026

That is a budget. It is not a deadline.

The budget is the unit

Headlines count physical qubits. The number that decides whether a box opens is logical qubits running a corrected circuit against a target, with a target that matters. A box closed by SHA-256 does not need the same machine as a box closed by secp256k1. CatBitcoin has held the line that the hash closes the box and the signature opens it, and the budget has to be split accordingly.

For secp256k1, the cited Shor resource estimates have settled into a band. A reasonable reading of the late-2025 to mid-2026 surveys is that breaking one secp256k1 public key in a realistic window needs on the order of low single-digit thousands of logical qubits sustained over hours to days, with tens of millions of physical qubits behind them. The figures vary by an order of magnitude depending on whether you count modular exponentiation, surface-code overhead, magic-state distillation, or the cost of a single-shot elliptic-curve variant.

For SHA-256, the budget is the same shape and a different order. Birthday-bound preimage search at the depth a box actually lives (80 bits of hash output) does not fold into a Shor problem. Grover is symmetric and pays in square roots, so the resource is qubits-times-toffoli depth, not qubits. A 128-bit preimage requires a circuit the community has measured in the millions of Toffoli, parallelisable across a budget that is large but not incomparable to the Shor figure, and only on the boxes that commit to SHA-256d.

That is the budget. It is not the deadline. The runway counter on this site tracks dollars, not logical qubits, and the two move on different clocks.

What the October 2026 ledger shows

Three public items from the last quarter move the needle. IBM's Heron r3 and the Condor-class successors are now documented at the 156-qubit (Heron) and 1,121-qubit (Kookaburra/Flamingo) physical tier with declared gate fidelities north of 99.7 percent at the gate set surface code wants. Google Quantum AI's Willow publication put a number on a single logical qubit at distance seven, with a logical error rate per cycle in the 0.143 percent region, and continued to publish magic-state budgets that put a single T-state a few orders of magnitude below the cost of a Shor run. Atom Computing, QuEra, and Pasqal each released a public roadmap with the phrase fault tolerant in a 2027 or 2028 column, sometimes both.

None of those machines breaks SHA-256. None of them breaks secp256k1. The interesting move is that the published logical-qubit count is now an annual line item on at least three vendor roadmaps, and the gap between physical and logical has stopped looking infinite. The runway counter on the site still reads in dollars; the qubit budget reads in error-corrected gates per second, and the two have stopped being the same story.

There is a secondary ledger item. NIST's PQC programme finalised ML-DSA (Dilithium), SLH-DSA (SPHINCS+), and FN-DSA (Falcon) in FIPS 204, 205, and 206, and the migration deadline for classical signatures moved from 2030 to 2035, with a 2030 stop on procurement. Bitcoin sits outside procurement rules, but the supply chain that builds HSMs and signing hardware does not, and that is where the box's window narrows.

A box, a budget, a window

The box on this site is shorthand for an unspent output whose script closes it with a hash and opens it with a signature. How a Bitcoin address labels the box and the key in the box, and the key that opens it cover the parts the budget will not change. The hash still closes the box even when the signature is broken, with the caveats spelled out in hash closes the box, signature opens it.

A box that has never revealed its public key is a different object. A pay-to-public-key-hash output, a pay-to-witness-public-key-hash output with a SegWit v0 path that was never spent, a P2TR output whose internal key was never exposed at spending: each of these stays closed at hash even on a Shor-class budget, because the public key that Shor would consume is not in the chain. The budget matters when the public key is on chain, and on chain means at the moment of spending or in an already-spent coinbase where the key sat in cleartext for a decade.

Two numbers, one box. The secp256k1 budget is the gating number for a box whose public key is on chain. The SHA-256 budget is the gating number for a box whose public key is hidden and whose hash is the only commitment. A miner or a custodian with a thousand-key wallet in 2026 does not have one number; it has two, and the larger of the two is the one that does not actually open the box.

What the counter used to say

The runway counter on this site, in the ten-billion issue and earlier, is a dollar figure: the notional value of bitcoin in addresses whose public key is on chain and is therefore a Shor target, counted at the front of the mempool. The figure is right and the framing is narrow. The dollar count is a proxy for the count of addressable boxes; the qubit budget is the cost of addressing them.

At a physical-qubit count of roughly a thousand, a logical-qubit count measured in single digits, and a gate-fidelity floor still being negotiated in vendor datasheets, the cost of breaking a single secp256k1 public key is the budget of a national-lab flagship machine, not a commodity cloud. That is a different sentence from one that reads as a deadline, and it is the sentence the dollar counter cannot print.

The two measures meet when the logical-qubit count reaches the band where a single run against a single public key is an overnight job on a multi-user machine. The date is not in the roadmaps, and the roadmaps have not promised it before 2030, with one outlier putting a single fault-tolerant run against a 256-bit elliptic curve in the early 2030s. The dollar counter is not a deadline either; it is a queue.

What to do before the budget moves

The CatBitcoin line is unchanged. Move coins whose public key is on chain into a box that hides it. That means a SegWit v0 output spent to a fresh address, or a P2TR output whose internal key is a MuSig aggregate and whose script path is unused. The hash closes the box; the hidden key buys time. A passphrase on the wallet that holds the box is the second key and is not negotiable.

Watch-only tools are a window, not an opening. The line is in watch-only is a window, not an opening, and a watch-only field is exactly the kind of place a key should not be pasted, ever. The budget moves in the background; the wallet does not.

The site will keep tracking the budget. The next update will look at the magic-state distillation cost of one T-gate against the surface-code distance, and the order-of-magnitude change in that cost between mid-2026 and the first 2027 vendor datasheet. That is the number that decides whether the runway is a year or a decade, and it is the number the dollar counter does not see.

Never paste a seed into a watch-only field.