The estimates keep falling: Why Bitcoin's quantum countdown is accelerating

The threat that Artificial Intelligence (AI) and quantum computing pose to Bitcoin (BTC) and cryptocurrencies in general is no longer a matter of if hardware will catch up; it is a matter of when.

Advances in AI-assisted research are adding a new dimension to the quantum computing threat, although neither technology can currently break Bitcoin’s cryptography on its own.

However, AI and quantum computing are quickly closing that gap faster than anyone had anticipated before 2026.

For more than a decade, the blockchain existed as a trustless, mathematically unbreakable ledger. Bitcoin’s security remained grounded on a problem so complex that no classical computer ever built could crack it.

That mathematical problem is the Elliptic Curve Discrete Logarithm Problem (ECDLP-256), which separates a crypto wallet’s public key from its private one.

To be fair, despite advances in AI over the last five years that threaten to unravel Bitcoin’s core security, this long-standing mathematical problem remains computationally infeasible for classical computers. However, the uncomfortable question is: for how long?

6M Bitcoin: The number defining the stakes

Quantum Alliance, a nine-member coalition launched in October 2026, estimates that approximately 6.4 million Bitcoin, 32.2% of the entire circulating supply, is held in wallets whose public keys are already exposed and are visible on the blockchain. This figure, which includes Satoshi Nakamoto’s 1.1 million BTC, is even higher at 6.9 million BTC, according to the European Supervisory Authorities (ESAs).

These are not theoretical figures; at current market prices near $82,000 per Bitcoin, they amount to upwards of $566 billion, yet remain structurally vulnerable.

Institutions under the ESAs published a report on the quantum computing threat to cryptography in September, saying that it could undermine some cryptography networks currently used to secure transactions, blockchains, databases and communications before it becomes commercially viable. The report did not explicitly mention when quantum computing could become commercially viable, a CoinDesk article said.

The quantum threat: What you need to know

The quantum risk to Bitcoin and cryptocurrencies stems from the early architecture of cryptography, where wallets using pay-to-public-key (P2PK) outputs, Bitcoin’s default format in its infancy, broadcast their public keys directly on-chain with every transaction made. This also applies to wallets that reused addresses. Once these public keys are visible, they become a target, including the 1.1 million BTC attributed to Satoshi Nakamoto that remain dormant in the initial P2PK addresses and have been silent for more than 15 years.

Again, Bitcoin in P2PK addresses does not face an immediate risk, as no current computer can solve the ECDLP-256 mathematical problem. The threat remains future-dated, with the debate centered on how far in the future it is and whether someone can accelerate the closure of that time gap.

However, a quantum computer running Shor’s algorithm could solve ECDLP-256 exponentially faster than any classical machine.

In March, Google significantly shortened its readiness deadline for Q-Day, the point at which current quantum computers could solve the ECDLP-256 problem and break public-key cryptography algorithms. Google said it is eyeing 2029 as the deadline to prepare for this event, urging the rest of the world to follow its lead and start implementing post-quantum cryptography (PQC) algorithms to augment or replace elliptic curves and RSA.

Heather Adkins, Google’s VP of security engineering, and Sophie Schmieg, a senior cryptography engineer, said in the post that “As a pioneer in both quantum and PQC, it’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.”

In context, Google argued that breaking the ECDLP-256 currently requires fewer than 500,000 physical qubits, a figure it has revised down 20 times. That said, Willow, Google’s most advanced chip, contains 105 qubits.

It’s not just Google; other organizations, including Oratomic, a Caltech-linked startup, predicted earlier in 2026 that the Q-Day could arrive sooner than previously expected.

Richard Carback, CTO at Postquant Labs and a founding member of the Quantum Alliance, puts 2028 as a very real date for a cryptographically relevant quantum computer. While Bryn Bennett, CRO at The Vault, doesn’t give a specific date, but puts it in operational rather than theoretical terms.

“Nobody knows the date, but the estimates keep falling, and the risk is one we can already plan for,” Bennett said in October during the Quantum Alliance launch, adding, “The question for custodians isn't whether the date is 2028 or 2035; it's whether you can migrate in time if it arrives early.”

AI accelerates timeline to Q-Day

This is where AI enters the equation, and the quantum computing landscape and outlook change by a magnitude. Until recently, the common consensus was that quantum hardware development was a binding impediment, as achieving more qubits takes time, capital and engineering.

While that challenge has not disappeared, AI has introduced a new dimension to the threat landscape by reducing the algorithmic cost of attacks, regardless of quantum hardware advancements.

In March, Eigen Labs introduced ECDSA.fail, a platform that challenges researchers to develop the most computationally efficient quantum circuit capable of breaking the cryptography securing Bitcoin and Ethereum. The platform attracted over 100 participants within the first eight weeks, working side by side with AI coding agents, including OpenAI’s GPT 5.6 and Anthropic’s Claude Opus 5. Together, the researchers submitted more than 400 circuit designs, reducing the spacetime cost by about 86%, from a 10.75 billion Toffoli-qubit baseline to 1.496 billion.

“Beyond the resulting circuits, ECDSA.Fail provides a case study of Open Autoresearch: a verifier-gated research process in which human participants and AI agents iteratively generate, implement, test, and share candidate improvements against a common measurable objective,” the researchers said.

Beyond Eigen Labs’ ECDSA.fail, other organizations and open-source communities are racing toward Q-Day, including Double AI, whose WarpSpeed autonomous AI system produced a circuit that was 2.5 times more efficient in spacetime than Google’s original design.

AI's implication for the quantum computing threat on Bitcoin is not hardware-based and does not crack cryptography today. Instead, it may lower the hardware threshold needed to run a successful attack.

AI and quantum computing are not on parallel tracks; they are compounding threats racing toward convergence.

A crisis is without consensus

Blockchain stakeholders are already exploring quantum-computing mitigation strategies, including Bitcoin’s Pay-to-Public-Key-Hash (P2PKH). This technology conceals the recipient's public key behind a hash, thus providing partial protection, according to Fireblocks.

Long-term, the ECDSA problem must be solved to improve cryptographic security. Several soft fork suggestions are currently under discussion.

That said, post-quantum cryptography migration remains slow because the Q-Day timeline is uncertain. Debates are centered around which algorithms to adopt, governance and the upgrade challenges on decentralized networks.

A successful quantum migration hinges on replacing the digital signatures underpinning every Bitcoin transaction. Achieving this demands broad consensus among developers, miners, wallet providers, exchanges, and millions of users on a new cryptographic standard, a coordinated migration timeline, and a strategy for handling dormant coins.

Despite the challenges, experts believe migration is feasible and can be achieved before the quantum computing threat to Bitcoin and other blockchain protocols materializes. In a recent YouTube video, Bitcoin.com said the industry can expect to add native post-quantum signature support, replace or strengthen weakened primitives, or harden consensus mechanisms.

Key takeaways: What you need to know

Before you dismiss the debate as binary, believing your Bitcoin is either fully secure or already compromised, pause. Both extremes are misguided and carry risk. The reality lies in a nuanced, often uncomfortable middle ground.

Your Bitcoin isn't being stolen now, but the window for complacency is narrowing. The AI and quantum threat is real, credible and well documented, but it isn't happening today, as no existing computer can break elliptic curve cryptography. However, the gap to Q-Day is closing faster than anyone had expected before 2026.

The 6.4 million Bitcoin at risk remains a structural vulnerability, not a software bug. The wallets’ public keys are exposed and permanently visible on the blockchain. This is the data a quantum attacker would need, and the only solution is migration to a quantum-resistant address format. This migration should happen before Q-Day.

AI and quantum computing are not the same threat, but compounded, they pose the same problem.

Q-Day has no exact timeline or confirmed date, but most organizations, including Google, cite 2028-2031 as the most likely consensus window.

Solutions exist, but none is complete.

The larger challenge is governance and consensus. This is harder than the technical threat, as it requires bringing together all stakeholders on a decentralized global network to agree, coordinate and execute the migration.

Bitcoin holders can start taking action now by avoiding address reuse, which exposes public keys. Migrate from P2PK outputs to P2PKH, P2WPKH, or Taproot addresses

Bottom line: The quantum threat is real, but it's even more nuanced because of AI’s compounding impact and the undecided outcome.