Coming soon. A published expert-panel assessment will be hosted here.
Summary of published findings
Current published assessments converge on a window of roughly 2029 to 2035 for the arrival of cryptographically-relevant quantum computers (CRQCs), defined as quantum computers capable of breaking 256-bit elliptic-curve cryptography in practical time. This is the cryptography behind Bitcoin’s ECDSA signatures. Methodologies vary across published assessments:- Some weight experimental progress on logical-qubit error rates.
- Some weight observed scaling trends in physical-qubit counts.
- Some weight institutional milestones (NIST PQC standardization, federal infrastructure migration mandates).
Implications
- Dormant exposed-key UTXOs are at risk first. ~1.7M BTC sit in Satoshi-era P2PK outputs whose public keys are permanently on-chain; ~3M+ additional BTC sit in reused P2PKH / P2WPKH addresses where the public key has been revealed by prior spending. These become spendable by whoever runs Shor’s algorithm first. Per-category breakdown: indexer.qbtc.net.
- Live spending is at risk via the mempool window. Any Bitcoin spend reveals the public key. A CRQC operator could race the spender to a competing transaction.
- The migration window is now. Migrations of large-scale infrastructure take years. NIST has standardized post-quantum signatures (FIPS 204 / ML-DSA) on the assumption that public infrastructure should be substantially migrated well before CRQC arrival.
See also
- The Quantum Threat to Bitcoin, plain-language explainer.
- Quantum Resistance (ML-DSA), QBTC’s cryptographic response.