Quantum computers are moving from theoretical threat to practical resource-estimation problem. In 2026, Google Quantum AI and collaborators published concrete numbers on what it would take to attack secp256k1, the elliptic curve securing Bitcoin and Ethereum account signatures: roughly 20 million logical qubits and 1.9 billion Toffoli gates under specific circuit assumptions. That estimate transforms the quantum threat from abstract to measurable, forcing the cryptocurrency industry to confront a specific gap between today's hardware and tomorrow's attack capability.

What Exactly Is the Quantum Threat to Cryptocurrency?

The danger isn't to the coins themselves, but to the cryptographic keys that authorize transactions. Bitcoin uses ECDSA (Elliptic Curve Digital Signature Algorithm) over secp256k1, while Ethereum's externally owned accounts use the same scheme. When you sign a transaction, you're proving you own the private key without revealing it. A sufficiently powerful quantum computer running Shor's algorithm could reverse that proof, deriving the private key from the public key visible on the blockchain.

The attack window matters enormously. Some keys sit exposed for years, like those in reused Ethereum accounts or certain Bitcoin output formats. Others are revealed only during a pending transaction, giving an attacker minutes or less to complete the computation before the transaction settles. This distinction shapes which systems face immediate risk and which have more time to migrate to quantum-resistant cryptography.

How Does Quantum Computing Progress Translate to Cryptographic Risk?

Google's recent error-correction breakthroughs show the path forward. In 2023, larger surface-code logical qubits outperformed smaller ones, proving that scaling up reduces error rates. In 2024, Google's Willow processor pushed that trend further, demonstrating that bigger quantum patches produce lower logical error rates. These aren't abstract physics results; they're engineering milestones that move quantum computers from random circuit sampling toward structured, fault-tolerant computation.

Logical qubits are the foundation of any practical quantum attack. A logical qubit is a virtual qubit built from many physical qubits using error-correction codes. To run Shor's algorithm against real cryptosystems, you need logical qubits with failure rates of one error per 1,000 operations or better, depending on circuit depth. Google's Willow experiment proved that surface-code error correction can achieve this scaling property, suggesting the hardware path exists.

What Are the Key Milestones on the Road to Q-Day?

The journey from today's quantum computers to a cryptographically relevant machine involves several overlapping developments:

• Error Correction Scaling: Demonstrating that larger quantum error-correction patches reduce logical error rates, a trend Google's recent work confirms is real and reproducible across multiple experiments.
• Logical Qubit Density: Increasing the number of logical qubits per physical qubit, allowing researchers to build larger fault-tolerant machines without exponential growth in hardware footprint.
• Gate Speed and Fidelity: Improving the speed and accuracy of quantum operations, since the 1.9 billion Toffoli gates needed for a secp256k1 attack must execute before error rates accumulate beyond correction capacity.
• Neutral-Atom Roadmaps: Alternative quantum architectures like neutral atoms are advancing in parallel with superconducting qubits, potentially offering different scaling properties and cost structures.

Theory and architecture work have also compressed the estimated resource requirements. In 2026, the Google team's estimate of 20 million logical qubits represents a significant reduction from earlier projections, reflecting improvements in circuit design and compilation methods. This doesn't mean the attack is imminent, but it does mean the target is no longer a moving goalpost.

Which Parts of Cryptocurrency Are Most Vulnerable?

The quantum threat isn't uniform across the crypto stack. Different components face different timelines and migration challenges:

• Bitcoin Spending Authorization: ECDSA and Schnorr signatures over secp256k1 face high quantum risk, but the exposure depends on output type. Older formats reveal public keys only at spend time, while newer Taproot-style outputs expose keys earlier, compressing the attack window.
• Ethereum Validator Keys: BLS signatures using BLS12-381 would need migration planning at the consensus layer, a complex undertaking that affects the entire proof-of-stake system, not just individual accounts.
• Bridge and Custodian Keys: These often use threshold ECDSA or multi-signature schemes around elliptic-curve keys. Bridges are already high-value targets; quantum risk compounds the operational danger.
• DAO Treasuries and Multisigs: Treasury keys tend to be long-lived and politically difficult to rotate, making them attractive targets for an attacker with a quantum computer.
• Proof Systems: Many deployed zero-knowledge proof systems rely on elliptic curves or pairing-friendly curves, facing medium to high quantum risk depending on design. Transparent proof systems using hash functions face lower near-term exposure.

Hash functions like SHA-256 and Keccak face only quadratic speedups from quantum computers, which changes security margins but doesn't create the same signature-forgery route. Proof-of-work mining faces lower near-term exposure because Grover's algorithm offers only a quadratic speedup in a system that is already parallel, economic, and hardware-bound.

How to Prepare for Quantum Risk in Cryptocurrency Systems

The industry has several levers to pull before a cryptographically relevant quantum computer arrives:

• Migrate to Post-Quantum Cryptography: Adopt quantum-resistant signature schemes and key-agreement protocols that are already standardized or in advanced development. This requires coordination across wallets, exchanges, validators, and smart contract platforms.
• Rotate Long-Lived Keys: Prioritize migration of keys that have been exposed for years, such as reused Ethereum accounts and bridge custodian keys. These face the highest risk because an attacker has unlimited time to complete the computation.
• Redesign Output Formats: For Bitcoin, transition away from output formats that expose public keys early. P2PKH and P2WPKH formats reveal keys only at spend time, compressing the attack window significantly.
• Plan Consensus-Layer Changes: Ethereum and other proof-of-stake systems need to plan validator key migration, a complex undertaking that requires coordination across the entire network.
• Audit Proof Systems: Review zero-knowledge proof systems and pairing-based commitments for quantum vulnerability. Some designs may be more resilient than others depending on their cryptographic foundations.

The timeline remains uncertain. Google's 2026 estimate of 20 million logical qubits is a concrete target, but reaching it depends on sustained progress in error correction, neutral-atom scaling, and circuit optimization. A machine with that capability could theoretically attack at-rest keys within days or weeks, and on-spend keys within minutes, depending on architecture and parallelism.

What makes this moment different from previous quantum-threat discussions is the specificity. Researchers are no longer debating whether quantum computers will threaten cryptography; they're measuring the gap between current hardware and the resources needed for a real attack. That gap is closing, and the cryptocurrency industry is beginning to move accordingly.