When will quantum computers actually be able to break Bitcoin?

Updated August 6, 2026

No one can give you a real date. The honest range runs from several years out to a decade or more, and it has been shifting for years without ever settling on a single number.

That's not evasion, it's just where the science actually sits. Breaking a live Bitcoin address means running Shor's algorithm against the secp256k1 curve, and Shor's algorithm needs a quantum computer with a large number of stable, error corrected qubits working together long enough to finish the calculation. Nothing built today comes close. Current machines are small, noisy, and error prone, useful for narrow research problems, not for anything resembling a real elliptic curve discrete logarithm at Bitcoin's key size.

There's a separate, smaller threat too. Grover's algorithm targets the hash functions inside Bitcoin addresses, but that gets handled by using larger output sizes rather than a redesign, and it's a far less urgent problem than the one Shor's algorithm poses. It's also worth remembering this isn't a Bitcoin-only question. Ethereum and most other major cryptocurrencies lean on the same family of elliptic curve cryptography and carry a similar exposure profile, so whatever timeline eventually plays out, Bitcoin won't be the only network facing it.

why estimates keep shrinking instead of settling down

Here's the part that confuses people. Researchers keep publishing lower estimates for how many qubits a cryptographically relevant quantum computer would actually need, and that keeps happening because the algorithms and the error correction schemes around them keep improving, not because anyone built bigger hardware. Earlier this year another round of estimates came in lower than the ones before it. That's a real pattern, and it deserves to be taken seriously rather than waved away.

But a shrinking resource estimate isn't the same as a shrinking timeline. Needing fewer logical qubits in theory doesn't mean anyone has built them in practice. The hardware side, keeping thousands of physical qubits stable and error corrected long enough to run a real calculation, hasn't moved anywhere near as fast as the theory papers. So the honest reading of shrinking estimates is that the error bars around the eventual date are still wide, not that a specific year just got more likely. Anyone offering you a specific year is doing guesswork, however confidently it's phrased.

what's already true today, regardless of the date

Roughly 5.4 million BTC, about a quarter of all bitcoin that will ever exist, sits in addresses where the public key is already visible on-chain, mostly because those addresses were spent from at some point in the past. A cryptographically relevant quantum computer, whenever it arrives, would threaten those exposed keys first. That figure includes an estimated 1.1 million BTC tied to Satoshi Nakamoto's early mining, dormant since around 2010, sitting in an old address format that never hid the public key to begin with. If you want a sense of scale, running that 5.4 million BTC through the sats converter makes it easier to picture just how much value that represents in absolute terms.

None of this means your coins are in danger this year, or next. It means exposure is uneven across address types, and it's worth knowing which category your own addresses fall into well before any quantum timeline resolves either way. The full explainer on Bitcoin's quantum exposure walks through the address types and the 2026 shift in the qubit estimates in more depth than makes sense here.

the debate isn't really about the date

Two draft proposals, BIP-360 and BIP-361, sketch out how Bitcoin might eventually add a quantum-resistant address format and a path for people to migrate funds into it. They're still drafts, not adopted protocol rules, and the specifics will likely keep changing as they go through review, so it's early to treat any particular detail as settled. Bitcoin's proposals sit alongside broader industry work here too: NIST finalized post-quantum standards like ML-KEM, ML-DSA, and SLH-DSA back in 2024, and Bitcoin hasn't committed to any one of them yet.

The genuinely contentious part isn't the cryptography, though. It's an idea floated alongside it, that spending from old, exposed, long-dormant addresses (Satoshi's coins being the obvious example) might eventually get restricted if they aren't migrated within some window. That runs straight into one of Bitcoin's oldest norms, that no one gets to decide whose coins are allowed to move. That argument will likely get settled through years of debate well before any quantum computer forces the question for real.

So treat "sometime this decade to next" as the honest answer rather than a hedge, and be skeptical of anyone more precise than that. If you'd rather spend the uncertainty productively than worry about a date nobody can name, check where your own coins actually stand with the wallet checker, since knowing your exposure tier matters a lot more right now than knowing the exact year a hypothetical machine gets switched on.