Quantum Computing and Bitcoin: What It Actually Is, How Far Along It Really Is, and Why the Hash Was Never the Weak Point

• The question: three questions wearing the same face
• What the machine is: interference, not a machine that tries every answer
• The milestone that was about error rates, not power
• What the machines are for, and where they actually stand
• Why the voices are irreconcilable, and why each one is sincere
• The correction: the hash was never the weak point
• The signature is the exposure, and the estimates are collapsing in public
• The migration: the schedule is the part we control
• The close

Quantum computing is real and advancing, the public resource estimates for attacking cryptography have collapsed by more than an order of magnitude in a few years, and none of it is close to breaking the hash that secures bitcoin — because the hash was never the part the attack targets.

DeepDives · 2026 · An AI–human collaboration that weighs every source, mainstream or alternative, under strict rules of truth and logic.

§The question: three questions wearing the same face

Ask whether quantum computing is close to breaking the cryptography that protects money, and you will get confident answers that contradict each other completely: it is years away, it is nearly here, it is a fantasy sold to investors. Almost all of that disagreement is people answering three different questions and assuming they are the same one. The first is what the physics permits: whether a quantum machine could ever do the thing at all. The second is what the engineering has actually built, today, with real hardware. The third is timing — when the thing that is physically permitted and not yet built becomes real.

This examination takes those three questions in order, then applies them to the specific fear that prompts most of the shouting: how close any of this comes to breaking the hash function that secures the bitcoin network. The honest answer begins with a correction, because the hash is not the part anyone should be worried about. The exposure sits somewhere else, and it changes who is at risk and how much is already standing in the open.

§What the machine is: interference, not a machine that tries every answer

Start with the popular description, because it is wrong in a way that makes everything after it harder. A classical bit is a switch: zero or one. A quantum bit, a qubit, is a physical system with two states that can also be placed into a combination of both, called a superposition, described not by a probability but by an amplitude — a number with a direction, which is the point, because numbers with directions can add up or cancel out. Two qubits can also be entangled, meaning they share a single joint state that cannot be described by listing what each one is doing separately. That much is genuinely strange, and it is not the source of the computing power.

The power comes from interference. A quantum circuit is designed so that the amplitudes of all the wrong answers cancel each other out, the way two sound waves cancel, while the amplitude of the right answer grows. Which makes the common claim that a quantum computer tries every possible answer at once and then picks the correct one false. You cannot look at all the answers; a measurement collapses the state and returns one outcome, chosen probabilistically. The entire craft is in arranging the cancellations so that the outcome you read out is the one you wanted — and so that there is some way to check it, because a quantum computer does not tell you that its answer was right.

A qubit is not a pristine mathematical object. It is a physical thing coupled to everything around it, and any stray interaction measures it, ruining the superposition — a process called decoherence. That is why quantum operations have error rates of roughly one in a thousand, sometimes one in ten thousand, while an ordinary computer’s operations do not fail at anything like that rate. The fix is the same idea that protects a noisy radio channel, taken to an extreme: instead of one fragile qubit, you build one reliable logical qubit out of many physical ones, with an error-correcting code constantly checking and repairing it.

And there is a threshold theorem, understood since the late nineties, which says that if the underlying physical error rate is below a certain level, then adding more physical qubits makes the logical qubit better rather than worse: the errors shrink exponentially as the code grows. That theorem is the entire basis for believing large quantum computers are possible at all. It is also the basis for the scepticism, because the theorem is conditional, and hitting the condition is where the decades have gone.

§The milestone that was about error rates, not power

Which makes the most important result of the past two years something almost nobody outside the field has heard of. In December of 2024, Google announced a chip called Willow, of one hundred and five physical qubits, and the headline number in the coverage was the qubit count, the least interesting thing about it. The result that mattered was that this was the first demonstration of operating below the threshold: for the first time, a larger error-correcting code produced a lower error rate than a smaller one, exactly as the theorem predicts.

The central prediction of fault-tolerant quantum computing — that errors get smaller as you scale — stopped being a theoretical hope and became an experimental observation. That is the milestone of this decade, and it is about error rates rather than power. The physical qubit count, by contrast, is mostly a marketing figure: a thousand noisy qubits with poor connectivity cannot do what a hundred good ones can.

§What the machines are for, and where they actually stand

There are three families of problems where quantum algorithms offer something classical computing cannot. The first is factoring and related number theory, thanks to an algorithm published by Peter Shor in 1994: the security of the modern internet rests on the assumption that certain mathematical problems are too slow to solve, and Shor’s algorithm makes two of them fast. The second is searching an unstructured space, thanks to Lov Grover in 1996, which offers a speed-up of a much weaker kind, and that weakness turns out to be decisive for bitcoin. The third, and the first to be proposed, is simulating quantum systems themselves: in 1982 Richard Feynman pointed out that a quantum machine is the natural instrument for modelling molecules and materials, because nature is doing quantum mechanics and a classical computer has to approximate it expensively.

That third application is where most sober people expect the first genuinely useful results — chemistry, and therefore eventually materials and medicine — rather than in breaking anything. A quantum computer is not a faster version of the laptop you are reading this on: it is not better at spreadsheets, or video, or running large language models. It is a specialised instrument for a few problems, the most consequential of which destroys public-key cryptography.

So where does the field actually stand? The only currency that counts is logical qubits, the error-corrected kind, rather than the physical ones on the marketing slides. As of the middle of this year, the verified record is ninety-six error-corrected logical qubits, demonstrated by a company called QuEra and published in January, with a rival, Quantinuum, having demonstrated ninety-four, and Microsoft and Quantinuum reporting twelve logical qubits at a logical error rate of about two in a thousand. Five years ago the number was zero.

But the second number matters just as much: the quality of the error correction, measured by the code distance. Those record logical qubits are operating at a distance of about four. Running Shor’s algorithm end to end to break real cryptography needs a distance of twenty-five or more. So there are two gaps, not one — a gap in how many logical qubits, and a gap in how good each one is — and both are closing, with the logical-qubit record roughly doubling in a single year.

There is a second axis worth reporting: what the machines can compute, rather than how many qubits they hold. Last October, Google reported the first genuinely verifiable quantum advantage: a task run on that same chip about thirteen thousand times faster than the best supercomputer, with a result that can be confirmed by repeating it on any machine of the same calibre, and with a stated path toward a real application in imaging and materials. The caveat is the same as everywhere else: the task was chosen partly because it suits the hardware, and it is not a problem anyone needed solved.

§Why the voices are irreconcilable, and why each one is sincere

The optimists are not fantasists. Companies and national laboratories have published roadmaps that cross the threshold inside this decade: an American Department of Energy target for a first fault-tolerant machine by 2028, a company called IonQ targeting one thousand six hundred logical qubits by 2028, IBM with a machine called Starling planned for 2029 and another called Blue Jay for 2033, and a newer company, Oratomic, which has raised three hundred million dollars specifically to skip the intermediate generation and build fault-tolerant machines directly.

The sceptics are not cranks either. Adam Back, one of the earliest figures in bitcoin and the head of a company that makes bitcoin hardware, said late last year that a machine capable of breaking these systems is probably twenty to forty years away. Other critics go further: the physicist Sabine Hossenfelder has been writing warnings about a quantum winter, and the mathematician Gil Kalai has argued that noise makes large-scale quantum computing impossible in principle — though that argument requires new physics beyond quantum mechanics to be true, which is why most specialists treat it as unlikely rather than decisive.

And the scepticism is earned, because the field has a press-release problem. Companies routinely use the phrase logical qubit loosely. One recent announcement claimed forty-eight logical qubits built from a code with only two physical qubits per logical qubit, and a code that thin cannot correct errors; it can only detect them. When that is what the marketing says, a listener is right to discount the marketing.

The most famous example of the pattern is older than any of this. In 2019, Google reported that its chip had performed in two hundred seconds a computation that would take the fastest supercomputer ten thousand years. Within weeks, IBM published an argument that a smarter classical approach would need about two and a half days, and over the following few years improved classical simulations closed much of the remaining gap. Nobody was lying; the estimate was honest and the assumptions moved underneath it. But it is exactly what the sceptics mean when they say a milestone is not a milestone until it has survived being attacked.

§The correction: the hash was never the weak point

Now to the specific fear — that a quantum computer breaks the S H A two fifty six hash — and to why that is not where the exposure is. Bitcoin is protected by two completely different kinds of cryptography, and quantum computing treats them completely differently. The first is the hash function, used in mining and in linking the chain. The second is the digital signature, which is what proves that you, and not someone else, are entitled to move your coins.

Against a hash function, a quantum computer gets the weaker of the two known quantum algorithms. Grover’s does not solve the problem; it only halves the exponent. The security of S H A two fifty six against an attacker trying to find an input that produces a given output drops from two to the two hundred and fifty-sixth to about two to the one hundred and twenty-eighth. That is still a number so large that writing it out in full would take about thirty-nine digits, and no quantum machine that anyone is discussing comes close to it. The halving is real, it is worth dealing with by moving to longer hashes, and it is not a fracture.

Grover’s algorithm is also, unlike the factoring algorithm, hostile to parallel computing. Running the search across a thousand machines speeds it up by only about thirty times, whereas a thousand classical machines gives you a thousand times the throughput. And mining specifically is protected by the difficulty adjustment, which raises the difficulty whenever more computing power arrives, as it did when specialised machines displaced ordinary ones. Put those together and the mining layer — the part people worry about — is the part quantum computing threatens least.

§The signature is the exposure, and the estimates are collapsing in public

The signature is the real exposure, and the reason is structural. Bitcoin’s signatures use a scheme called E C D S A on a particular elliptic curve, and elliptic curve cryptography is exactly what Shor’s algorithm defeats. The difference from the hash is categorical: the hash merely gets weaker, while this gets broken, because the algorithmic structure that makes it hard disappears.

There is a second, subtler problem, which is about which public keys are visible. To spend from a modern bitcoin address you reveal a public key, and the network checks a signature made with the matching private key. In the ordinary case that key is revealed only at the moment you spend, so the exposure lasts the few minutes between your transaction entering the network and being confirmed in a block. That is the first attack: intercept a pending transaction, derive its private key, and re-issue the transaction to your own address before the original is confirmed. Google’s own research paper from March of this year put that attack inside the confirmation window, deriving a key in about nine minutes against a block interval of about ten.

The second attack needs no timing at all, and it is the larger one: coins sitting in addresses whose public key is already public, permanently, on the chain. That includes the very early outputs, where the public key was written into the output itself rather than being hashed, and it includes the roughly one point one million coins attributed to bitcoin’s pseudonymous founder, which have never moved. It also includes any address that has ever been spent from, because spending publishes the key forever.

How much is exposed depends on how you count, so it is worth giving both figures rather than the one that sounds better. The Human Rights Foundation estimated last year that about six point five million coins sit in address types whose keys are already visible on the chain, and that of those, about one point seven million, including the founder’s coins, have not moved in a decade and are probably lost — meaning nobody can migrate them even if they wanted to. Coinbase, which convened a panel of academic cryptographers and published a position paper in April, put the broader figure at about six point nine million coins. The definitions differ, so the totals vary by a few hundred thousand coins; the important point is not the exact number but its nature. Millions of coins, on the order of a third of the supply, are already in a form where the only thing standing between them and a quantum attacker is the attacker’s machine not existing yet.

Now, how fast is that machine arriving? This is where the story stops being about hardware and becomes about the attack itself, because the estimates of what it would take have fallen dramatically, in public, in the last two years. Start with the general problem of breaking the encryption that protects ordinary internet traffic, known as R S A. In 2019, two researchers, Craig Gidney and Martin Ekerå, published the standard estimate: a key of two thousand and forty-eight bits would need about twenty million physical qubits and eight hours. In May of last year, Gidney published a follow-up that cut the requirement to under one million qubits by changing the arithmetic, compressing how idle qubits are stored, and making a key component nearly as cheap as an ordinary operation. That is a twentyfold reduction in six years, with no new hardware — just better use of the hardware you would need. Then in February, a group published an architecture using a newer family of error-correcting codes that claims under one hundred thousand physical qubits, another order of magnitude, though with a large condition attached: the design assumes real-time decoding at microsecond speeds, which has not been demonstrated, and the paper itself does not claim to have brought the day closer. That distinction, between a clever paper and a working machine, is the whole argument between the optimists and the sceptics.

The sharper version of this story is about bitcoin specifically, because the target is smaller than R S A and the estimates have collapsed faster. The attack on a bitcoin key is not factoring; it is solving the elliptic curve discrete logarithm, where a key is only two hundred and fifty-six bits. Older academic estimates put the requirement in the low thousands of logical qubits. Google’s March paper, using a smaller and cleverer circuit, estimated between one thousand two hundred and one thousand four hundred and fifty logical qubits, which it said could be carved out of fewer than five hundred thousand physical qubits on a superconducting machine, deriving a key in minutes. Then last month, IonQ published what it calls the first fully compiled blueprint for the attack, costed end to end rather than estimated at a high level, and arrived at a different shape: nineteen thousand three hundred and ninety-seven physical qubits, far fewer than Google’s, but twenty-five point seven days per attempt, with a success probability of about sixty per cent per run. That is a different machine with a different trade: fewer qubits, much more time.

And then there is the strangest development of all, which is a public competition. A group called Eigen Labs runs an open leaderboard where anyone can submit a smaller circuit for the attack, scored by the product of qubits and gates, and the frontier has been moving month by month: as of last month the best entry used about one million two hundred and eighty thousand operations on about one thousand one hundred and fifty qubits. Four hundred and thirty-four submissions have been accepted from a hundred and seventeen solvers, many of them artificial intelligence models. The point of that leaderboard is uncomfortable: the algorithmic floor under this attack is falling even in periods when no new hardware ships.

§The migration: the schedule is the part we control

Put the two halves side by side, because it explains why serious people disagree. On the hardware side, the verified record is ninety-six logical qubits, at a code distance of about four. On the attack side, the best public circuit wants somewhere between eight hundred and one thousand four hundred logical qubits, and will need a code distance of twenty-five or more to run without failing. That is a gap of roughly an order of magnitude in quantity, plus a substantial gap in quality, plus the whole engineering problem of running error correction fast enough. An order of magnitude sounds close, and in a field where records doubled in a year it sounds closer. But the gap has three independent parts, each has to close, and the distance requirement is the one most roadmaps are least specific about. The honest answer to when a machine arrives is therefore: not this decade, probably the next one.

What matters more than the date is how long it takes to move a network once the date is known, and that is where the migration arithmetic takes over, because it is the part under human control. Consider what it would take to move every bitcoin into a new, quantum-resistant form. The network has roughly one hundred and ninety million individual unspent outputs — separate pockets of coins — and it processes about seven transactions per second, with blocks already close to full. Moving every one of those outputs into a new address type is on the order of a year of blocks doing nothing else at all, and some of it cannot be done, because the coins whose keys are lost cannot be signed for by anyone. That is the timetable that has to beat the machine.

Public planning already reflects it. The American standards body, which finished its first post-quantum cryptographic standards in 2024, has said that the vulnerable algorithms should be deprecated after 2030 and disallowed after 2035 for federal use, and the national security agency is moving faster still, requiring new systems to use quantum-resistant cryptography from 2027. Those dates are not predictions about quantum computers, but about how long it takes to change a large system, and they are the reason the migration clock is already running even for people who think the physics is decades away.

Bitcoin’s own answer is a proposal called B I P three sixty, authored by a small group of developers and merged into the official repository in February. Originally named for quantum-resistant hashing and later renamed, it defines a new address type designed to be compatible with the existing system, so that coins can be moved into it before the threat is urgent — and it targets first the address types most exposed, particularly the newest ones, which turn out to be a problem, because a design choice meant to make complex transactions more efficient also publishes the key earlier than the old format did. That is an uncomfortable irony for anyone who assumed newer meant safer. There is a working implementation on a test network, and warnings from institutions with large holdings, including Fidelity, that the migration has to be deliberate.

The sharpest question in the area is not technical. On Bitcoin Audible, Guy Swann devoted an episode to reading and unpacking an article by Jameson Lopp. The foundational principle of self-custody is that not your keys means not your coins. Its corollary should be that your keys mean only your coins — meaning the network should not allow someone else to take coins merely because they solved the mathematics. That produces a genuine dilemma. If a quantum computer can derive keys for coins that are provably abandoned, whose are they. If the network does nothing, the first entity to build such a machine, most likely an already powerful institution or a state, simply takes millions of coins, and the distribution of the money becomes a function of who got there first. If instead the protocol is changed to deprecate the old signature type on a specific date and refuse to honour it afterwards, those coins are destroyed rather than stolen — but you cannot tell the difference between a coin whose key is lost and a coin whose owner simply has not moved it since 2012, so the burn would destroy some people’s savings to protect everyone else’s. That debate is unresolved, it is a governance question rather than a physics one, and it is the reason this topic belongs in a series about money rather than a series about computers.

For an individual, the exposure does not depend on the arrival date. The risky positions are coins in the old format where the key is written on the chain, any address that has been reused, the newest format that publishes a key when the address is created, and — once a machine exists — the minutes during which a transaction is pending. Coins held in a fresh address that has never been spent from, in the modern hashed format, are not exposed while they sit there; the moment they move, the clock in the mempool starts. Which is why the mitigation that exists today is the oldest advice in the field: never reuse an address, spend from fresh ones, and treat the pending window as the part that matters. None of that helps the millions of coins whose owners cannot move them, and none of it helps if the migration begins after the machine exists.

§The close

Here is the verdict, in the form this series uses: what is supported, what is unresolved, and what is contradicted. Supported: that quantum computing is real and advancing; that the error-correction threshold has been crossed experimentally; that the resource estimates for attacking public-key cryptography have fallen by more than an order of magnitude in a few years, in public, and that attacking a bitcoin key is easier than attacking a standard internet key. Unresolved: when a machine capable of it will exist, where the credible estimates run from the late twenty thirties to the twenty forties and beyond, with the sceptics arguing the milestones are still absent — and what the network should do about the coins nobody can move, which is a decision about property and not about mathematics. Contradicted: the specific fear that a quantum computer is close to breaking the S H A two fifty six hash. That is not the weak point, and on any published estimate it is not remotely reachable. Grover’s algorithm halves it to a hundred and twenty-eight bits, which is still a wall; the halving is manageable by moving to longer hashes; and mining is the least threatened part of the entire system, for structural reasons that have nothing to do with the arrival date.

Because a verdict that cannot be checked is not a verdict, here is what would falsify this one. If a fault-tolerant machine appeared with a code distance of twenty-five or more at a scale in the thousands of logical qubits, the timing half of this examination would need rewriting, and the migration arithmetic would become urgent within a single news cycle. If the public leaderboard for the attack circuit stalled, or began to grow again, the claim that the algorithmic floor is falling without new hardware would lose its evidence. If the error-correction threshold result failed to replicate on other hardware, the basis for believing in large fault-tolerant machines at all would be back in doubt.

But the correction that structures this piece is not hostage to any of those. It is a statement about which primitive the attack touches, and it holds whether the machine arrives in 2038 or in 2060. Grover’s algorithm does not break S H A two fifty six and never will; it halves a difficulty that has room to spare, and the network’s difficulty adjustment absorbs the rest. Shor’s algorithm breaks the signature, and that is where every serious effort, every falling estimate and every migration question actually lives. If you take one thing from this examination, take the shape of the problem: for bitcoin, quantum computing is not a physics problem yet. It is a scheduling problem, and the schedule is the part we control.

Sources: this article names its sources inline — the quantum algorithms of Peter Shor and Lov Grover, Richard Feynman’s proposal for quantum simulation, and the threshold theorem of fault-tolerant quantum computing; Google’s Willow chip result, its 2019 advantage claim and IBM’s rebuttal, and its later papers on circuit design, key recovery and verifiable advantage; the logical-qubit records of QuEra, Quantinuum and Microsoft; the roadmaps of the American Department of Energy, IonQ, IBM and Oratomic; the sceptical cases of Adam Back, Sabine Hossenfelder and Gil Kalai; the resource estimates of Craig Gidney and Martin Ekerå and their revisions, and the February architecture using newer error-correcting codes; IonQ’s compiled blueprint for the attack and the public Eigen Labs leaderboard; the exposure estimates of the Human Rights Foundation and Coinbase’s April position paper; the deprecation schedules of the American standards body and the national security agency; the B I P three sixty proposal and its test-network implementation, with Fidelity’s published warnings; and the argument of Jameson Lopp as read by Guy Swann on Bitcoin Audible. Every source is weighed with the same skepticism regardless of institution, affiliation or business model. The audio version of this article, read by DeepDives, is available on Wavlake.