How Close Are We? The Quantum Timeline

When you hold Bitcoin, what you actually own is knowledge of a private key. Elliptic-curve cryptography (ECC) lets you prove you know it without ever revealing it, using a digital signature and a corresponding public key. 

But a powerful enough quantum computer running Shor's algorithm can derive the private key from an exposed public key, and roughly 7 million BTC sit in addresses where the public key is already visible. 

No such machine exists yet, not even close. But the gap is closing, and that leaves the obvious question. When? 

To be honest, nobody knows, and anyone who gives you a confident, precise date is guessing. But we know what the machine has to look like, we can see how fast the requirements are moving, and we can read what the people with the most to lose are already doing.

Most coverage confuses physical qubits with logical ones. A physical qubit is the actual hardware produced, for instance a superconducting circuit or a neutral atom, and on its own it has relatively high error rates, way too high to be used directly for running Shor’s algorithm at a cryptographically relevant scale.  

A logical qubit is made by applying error correction techniques to a group of physical qubits. Increasing the size of the group reduces the error rate, potentially down to the levels required to threaten public key cryptography. While physical qubit error rates are caused by noise, logical qubits don’t have that physical limitation and could effectively act as ideal compute units: that’s why they are the unit that counts.  

So when a quantum chip is announced with "a thousand qubits," ask first whether they are physical or logical, and second, the error rate. A large logical qubit count means little if the errors are high — for instance, because the underlying physical qubits are not good enough or the number of physical qubits used for a single logical qubit is insufficient — if the result is detection rather than real-time correction, or if it leans on post-selection.  

There is also no fixed exchange rate: one logical qubit might cost ten physical qubits or a thousand, depending on the required logical error rate and on the error-correction code, which in turn might be viable only for specific qubit technologies. So you cannot splice the best figures from rival technologies into one curve and announce that we are two years away.

The target is on the order of a thousand logical qubits at around one error in a trillion operations. Today we are at fewer than a hundred — far from those error rates. The gap is large, and that is the honest starting point.

Take any company's roadmap with a large grain of salt. Some have been wildly aggressive; others have hit their milestones year after year. Remove the outliers and the credible plans converge on two dates.  

Around 2029, several groups expect hundreds of logical qubits at low error rates, which is not enough to break ECC but is the point where the threat stops being debatable. Around 2032, the same roadmaps project thousands of logical qubits at error rates low enough to matter, which is a cryptographically relevant quantum computer (CRQC). 

The catch is the error rate, which is harder to deliver than the qubit count. A thousand logical qubits by 2032 is plausible; a thousand at one error in a trillion is the optimistic end of the range.

The bar itself is falling on two fronts. On the algorithm side, smarter implementations of Shor's 1994 method cut the requirement to break RSA, another widely used public-key system, from 20 million physical qubits in 2021 to about one million four years later, both from the same group at Google.  

On the logical side, earlier this year the requirement for running Shor’s algorithm dropped from a few thousand logical qubits to around one thousand, at the same time reducing the number of operations required to execute the algorithm, thus relaxing logical error rate requirements. More recently, independent researchers proved how AI can optimize key steps of the algorithm, further reducing the gap from current capabilities to cryptographic relevance. 

The estimate I watch most closely concerns Bitcoin specifically. On a neutral-atom machine, breaking elliptic-curve cryptography at Bitcoin's security level is estimated to need a physical qubit count in the tens of thousands. Early experiments have been extended in scale up to only a few thousand atomic qubits.  

Still, the experiments are about control and not yet about sustained computation. Better software will refine the algorithms, but it will not hand anyone a working system with extremely low error rate at scale. The computer still has to be fabricated, and that does not happen overnight.

Look past press releases to the bodies whose job is to be early and careful. Following a mandate from the U.S. government in 2022, the National Institute of Standards and Technology (NIST) standardized a timeline for today's public key cryptography: deprecated from around 2030, meaning still allowed but discouraged, then disallowed after 2035.  

In 2024, the National Security Agency (NSA) required national-security systems on post-quantum cryptography by 2032. In June 2026, the U.S. government mandated even stricter deadlines: 2030 for key exchange, which is needed for encryption, and 2031 for digital signatures.  

The Defense Advanced Research Projects Agency's (DARPA) Quantum Benchmarking Initiative is testing whether an industrially useful machine is achievable by 2033, and in March 2026 its managing director said for the first time that it now seems "likely that someone will build a utility-scale quantum computer by 2033."  

The replacements, meanwhile, are ready: post-quantum signature schemes, lattice-based and hash-based, standardized, tested, and not vulnerable to Shor's algorithm. Put the dates side by side, from the White House, the NSA and DARPA, and they cluster in the same place: there is a concrete risk that a CRQC is realized by the early 2030s. The rest of the digital world has already started moving on that basis.

So, how close are we? The credible window runs through the early-to-mid 2030s, and the diminishing requirements keep moving that date closer. I would not absolutely exclude that a CRQC is realized as early as 2029. Maybe extremely slow and expensive, but still theoretically capable of extracting a private key from a public key. 

Do not wait for a clear signal, and remember we cannot assume that all progress is promptly disclosed publicly. By the time a quantum computer visibly proves capability to break today's cryptography, the chance to migrate in an orderly way has already passed.  

What I watch for is sustained error correction on operations involving more than one logical qubit, and low error rates measured on a full computation, including the system around the quantum processing unit, from input to final output. That has not happened. When it does, the conversation changes quickly.  

None of this calls for panic, urgently moving all coins today. It calls for paying attention, and for being ready to migrate early rather than late. When the path opens, that is easier with a custodian that has been native to this from the start.

If you want to stay in the loop all things quantum, please subscribe here.