The real question in Bitcoin’s quantum threat is who could actually use a multi-billion dollar quantum machine for criminal activity?
Quantum computing has advanced materially over the past 18 months, but the field remains in the transition from noisy hardware to early fault tolerance.
The key shift is away from raw physical-qubit counts and toward logical qubits, gate fidelity, runtime, and error correction. That shift is important for Bitcoin because risk estimates are driven by logical qubits and fault-tolerant operations rather than headline hardware totals.
Progress is visible across three fronts: below-threshold error correction, small logical-qubit demonstrations, and deeper circuits with lower noise.
In late 2024, Google’s Willow chip demonstrated below-threshold error correction, in which error rates fell as the encoded system scaled up. IBM says its current systems can run certain circuits with more than 5,000 two-qubit gates and has published a roadmap to a 200-logical-qubit fault-tolerant system by 2029.
Quantinuum has reported 48 error-corrected logical qubits and 64 error-detected logical qubits from 98 physical qubits, along with 50 error-detected logical qubits on Helios at better-than-break-even performance. Microsoft and Atom Computing reported 24 entangled logical qubits and computation with 28 logical qubits on neutral-atom hardware.
The sector remains short of a large-scale fault-tolerant machine. That is one reason DARPA’s Quantum Benchmarking Initiative exists.
Its target is a quantum computer whose computational value exceeds its cost by 2033, and the agency is still validating competing architectures rather than certifying that any team has already reached that point.
Today’s systems can do four things with credibility. They can run benchmark problems beyond classical brute-force methods, including Google’s random circuit sampling and more recent work on Quantum Echoes.
They can perform limited, specialized simulations in physics and chemistry, often in hybrid workflows with classical high-performance computing. They can demonstrate logical qubits and fault-tolerant subroutines on small scales. They also function as testbeds for error correction, decoding, and control systems.
No public system has anywhere near the logical-qubit count, fault-tolerant gate budget, or sustained runtime needed for cryptographically relevant attacks on secp256k1. Google’s Willow contains 105 physical qubits.
The leading public demonstrations of logical qubits remain in the tens, not the thousands. A recent estimate from Google researchers and co-authors puts a Bitcoin-relevant attack in the range of 1,200 to 1,450 logical qubits and tens of millions of Toffoli gates, leaving a large gap between current machines and a cryptographically relevant system.
Bitcoin is not under quantum attack today. The threat has moved out of the science-fiction category and into the planning category.
Google’s new estimate reduces the required resources enough to sharpen the central question: whether Bitcoin and the broader cryptographic stack can migrate before fast-clock fault-tolerant systems cross the threshold for cryptographically relevant attacks.
Even if a top lab reaches that threshold sooner than expected, the limiting factor for bad actors is likely to be access, because the first cryptographically relevant systems would still be facility-scale machines with billion-dollar economics rather than tools that can be quietly bought, rented, or assembled at criminal scale.
Yes, we need a migration plan for Bitcoin. Yes, it's worth starting earlier than later. But no, your wallet is not going to be cracked, and the BTC stolen by a quantum computer anytime soon. Probably not even within our lifetime, to be honest.
Once a quantum computer exists in a frontier lab that can crack Bitcoin, if the migration isn't complete, the price will likely crater on sentiment, but there will still be decades before on-chain data is genuinely at risk.