Quantum computing is approaching a threshold. This threshold is called “Q-day”: the moment a quantum machine is powerful enough to break the public key encryption which underlies our digital world.
This day will not arrive like some sudden, apocalyptic event of science fiction, but its impact will penetrate every capillary bed of the digital world. Bank transfers, medical records, communications, digital assets: almost all data protected by modern ciphers will lose its protection on Q-Day.
Threats to bitcoins and other cryptocurrencies are both urgent and complicated. To understand the scale and distribution of the risks involved is essential, for not all wallets are equally vulnerable.
What Is Q-Day
Q Day refers to the point at which a quantum computer can use Shor’s algorithm and effectively break the RSA and elliptic curve encryption schemes and other forms of public-key cryptography in an acceptable time frame. These schemes are all based on a mathematical truth: to find the private key from a public key takes an astronomically long time on presently available classical computers.
Shor’s algorithm was to change this equation, as it turned the problem of factoring and extracting the logarithm from the realm of the purely logical into the realm where superposition and entanglement ruled, reducing these problems from exponential difficulty to polynomial time. With the help of a powerful enough quantum computer, a problem that would take a purely classical machine thousands of years to solve could be done in minutes.
Q-day is not a date that one can note precisely on one’s calendar. It is a statistical date, a landmark of probability. But its direction is certain: once passed, all of the digital security system will undergo a complete reconfiguration.
A Shrinking Timeline
Q-DAY has changed drastically in the past year. In March 2026, the time of the first quantum cryptographic transition set by Google was moved from the 2030s to 2029. It was not based on a hardware breakthrough, but on an optimization of the underlying calculation: the Shor cipher’s quantum circuits were redesigned to require only about 500,000 physical qubits to decipher a 256-bit key, down from tens of millions.
This is still a long way off, for the most powerful quantum computers that have been publicly disclosed to date contain fewer than ten thousand physical qubits. And even more significantly, qubit error rates are very high and would require an enormous amount of redundancy to correct them. Moreover, there is a large gap between the underlying physical qubits and the logical qubits necessary to perform the kinds of operations required by cryptography.
But the shorter timescale sends a message of its own. Q-day is no longer just an abstract threat to be deferred as far as possible, and the shrinking timescale indicates that Q-Day is no longer an abstract concern that can be postponed indefinitely. Singapore’s Cyber Security Agency, in an October 2026 advisory, estimated that a cryptographically relevant quantum computer could emerge within 5 to 10 years. Lorenzo Valente, director of digital asset research at Ark Invest, is more optimistic than he was a year ago that Bitcoin will find a solution before Q-DAY, because the threat has now been seen as an ‘evolutionary’ one rather than a sudden one.
The Leakage Already Underway
It is precisely this feature of Q-Day that is most paradoxical: its effects take place before its arrival.
Today, bad actors are already storing encrypted data, waiting for the upcoming quantum-computing attack. For sensitive data that must remain confidential for a long time (personal medical records, government secrets, and financial records), “delayed decryption” renders today’s encryption solutions virtually useless against Q Day. The security industry has a name for this strategy: harvest now, decrypt later.
Mosca’s theorem offers a concise and quantitative way of formulating this risk. If the period that data needs to be kept secret, added to the time required to migrate to safe systems, is longer than the time until the appearance of a quantum computer, then you are already exposed. For certain long-lived sensitive data, this inequality is already satisfied.
Bitcoin’s Particular Vulnerability: The Exposed Key Problem
In discussions of Q-Day, Bitcoin occupies a special and precarious position.
Bitcoin relies on the Elliptic Curve Digital Signature Algorithm (ECDSA) to prove transaction authorization. The key problem is this: when a transaction is published on the block-chain, the public key is exposed. A sufficiently powerful quantum computer could theoretically find the private key from this exposed public key and thus obtain the funds.
According to Glassnode co-founder Rafael Schultze-Kraft, about 6.26 million BTC, or 31.2% of the total supply, is stored in addresses for which the public key is already known on the chain. This figure has grown from 24.8% in early 2021, and now corresponds to the level of 2016.
How Exposure Happens
Bitcoin addresses become exposed through several mechanisms:
By address reuse: The keys to about 4.33 million BTC are compromised because the funds have already been sent from these addresses, revealing the public key. This is the biggest problem and the easiest to resolve: the owners can simply transfer their coins to new addresses.
The output format itself exposes another 1.94 million BTC. This includes:
- 1.71 million BTC in P2PK format wallets, where the public key was visible from creation. This category includes 1.1 million BTC associated with Satoshi Nakamoto.
- 222,000 BTC in Taproot outputs, where the output public key is visible at creation.
Exchange Concentration
Exchanges hold a large part of the exposed supply. Approximately 1.79 million BTC on exchanges sit in addresses with publicly visible keys. The degree of exposure varies between exchanges.
- Binance: ~83% exposed
- Coinbase: ~10% exposed
- Robinhood: ~100% exposed
- Bitfinex: ~100% exposed
- Grayscale: ~49% exposed
- Fidelity: ~2% exposed
Schultze-Kraft emphasised that these numbers could not be used to assess exchange security, nor did they imply that quantum attacks are currently feasible.
The Economic Filter: What Attackers Would Actually Target
Not every exposed wallet is worth hacking. Quantum computing resources are costly, so attackers will probably attack only those with a high value. Then we have the following picture:
Ethereum researcher Justin Drake has suggested that wallets with a balance of less than 50 BTC would be partially protected by what he calls the Satoshi shield. That shield would consist of about 20,000 public addresses related to Satoshi, each containing 50 BTC, which would likely be the first targets because of their symbolic and financial value.
AI: The Unforeseen Accelerant
A new dimension has entered the Q-Day discussion: artificial intelligence.
In October 2026, Justin Drake, a researcher from the Ethereum Foundation, gave a startling warning. He claimed that artificial intelligence might be able to break the encryption of Bitcoin and Ether even before the arrival of quantum computing.
Drake wrote on X that elliptic curves appear especially vulnerable to superintelligence, pointing to an explosion of AI-driven mathematical breakthroughs. He urged the blockchain industry to prepare for ‘bunker mode’, a controlled, mass migration of funds to new addresses that have never signed a transaction, keeping public keys hidden behind a hash.
The worst-case scenario is that ECDSA could be broken in months, not years, using available hardware like a large GPU cluster. He emphasized that holders should not panic or rush, and that exchanges like Binance, Robinhood, Bitfinex, and Tether should work to strengthen their cold-storage security.
It is a sharp escalation in the anxiety that the cryptography world is experiencing. In March, after the paper of Google showed that the breakthrough could come sooner than expected, Mr. Drake gave a 10% or higher probability of Q Day by 2032.
Probability Estimates: What the Models Say
AI models have been used to estimate the probability of Bitcoin’s ECDSA and Schnorr signatures being practically broken during the following time periods:
- Within 2 years: 0% to 2% (all models)
- Within 20 years:
- ChatGPT-6 Astra: ~76%
- Claude: ~66%
- Grok: ~60%
- Deepseek: ~34%
The models all regarded quantum encryption as the primary long-term danger. They also said that there were currently no known practical classical attacks against secp256k1, and that advances in AI had not yet led to any verified cryptographic breakthroughs.
The Migration Challenge
Protecting vulnerable wallets requires a migration to post-quantum technology. This is a process that may take years to coordinate across the network.
Coinbase, which holds around five percent of all the world’s bitcoins, spelled out its technical priorities for the transition in October 2026. The exchange warned that Bitcoin consensus changes and ecosystem migrations can take years, so it is important to start this work now.
Coinbase’s Key Recommendations
Coinbase’s proposals include several technical priorities:
Post-quantum outputs should decouple the output type from the signature scheme. This allows a system to be introduced, replaced, or added without having to redo it. P2MR (BIP-360) and P2TRv2 are examples of such flexible implementations.
A ‘one-out-of-two’ approach is Coinbase’s preferred mechanism, whereby the same funds carry two spending paths: one authorized by a classic ECDSA or Schnorr key, the other by a post-quantum key. By using this approach, a user would be able to sign classically today and switch to quantum-resistant signing when the need arises.
MPC compatibility: Multiparty computation friendliness is important for institutional custody, and at least one viable post-quantum proposal should have promising MPC compatibility.
The Abandoned Coins Problem
The hardest part of the migration is not the cryptography but the funds that will not be transferred. Coinbase is of the opinion that the treatment of legacy coins (including P2PK outputs, reused addresses, dormant balances, and Satoshi-era balances) should be a separate matter of engineering and governance.
Whatever remedy is proposed has to be quantum-safe, so that a potential attacker, having only a public key, cannot take advantage of the remedy. The question is open at the moment, since, says the company, it can be sorted out while the signature work goes on rather than delaying it.
Preparation, Not Panic
On Q-Day the reaction should not be one of improvised emergency; it must be a planned system of migration.
The National Institute of Standards and Technology (NIST) officially released in 2024 the first post-quantum standards, including CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures. These are based on lattice cryptography, whose security does not depend on integer factorization or discrete logarithms, making them immune to Shor’s algorithm.
But standards do not constitute a working system. There are certifications of hardware security modules to be made, changes to the certificate issuance structure, protocol compatibility adjustments, and, last but not least, the problem of coordination.
For Bitcoin holders, the practical advice is straightforward:
- Use fresh addresses: Never reuse an address that has already been spent from.
- Monitor exposure: Check whether your addresses have ever been spent from and whether they continue to receive funds.
- Consider “bunker mode” preparation: Move funds to addresses that have never signed a transaction, keeping public keys hidden.
- Institutional holders should track UTXOs: Identify which funds have ended up behind exposed keys and gradually migrate through normal spending.
The most pragmatic attitude comes from the IEC: the exact date of Q-Day matters far less than one might think. The really important thing is the relation between three factors: the time that your data must remain secret, the time required to migrate, and the time until the attack comes. As soon as the total time of the first two exceeds that of the third, the danger ceases to be hypothetical and becomes real.
Bitcoin’s calculation is already uncomfortable. With 31% of the supply exposed, a migration period measured in years, and artificial intelligence threatening to accelerate the process, the window of opportunity for preparing is closing. But it is not yet closed
by AARON JAMES
SOURCES
Bitcoin Exposure Data (6.26M BTC / 31.2%)
https://forklog.com/en/glassnode-assesses-bitcoin-with-exposed-public-keys/
Google Quantum Paper (500K Qubits / 2029)
https://thequantuminsider.com/2026/03/31/google-suggests-quantum-attacks-on-cryptocurrency-encryption-may-require-fewer-resources/
Coinbase Post-Quantum Migration Proposal
https://www.coinbase.com/en-gb/blog/working-together-on-btc-post-quantum-readiness
Singapore CSA Quantum Timeline (5-10 Years)
https://www.csa.gov.sg/news-events/press-releases/csa-sets-out-quantum-safe-migration-timeline-for-organisations-and-launches-new-grant/
Justin Drake AI Warning (Bunker Mode)
https://tech.yahoo.com/cybersecurity/articles/ai-could-break-bitcoin-months-191229495.html