What Is Q-Day? The Quantum Threat to Bitcoin Explained

Quantum computers can’t crack Bitcoin’s encryption today, but new advances from Google and IBM suggest the gap is closing faster than expected. Their progress toward fault-tolerant quantum systems raises the stakes for “Q-day”, the moment when a powerful enough machine could crack older Bitcoin addresses and expose more than 711 billion dollars in vulnerable wallets.

Upgrade Bitcoin the post-quantum state will take years, which means the work must begin long before the threat arrives. The challenge, experts say, is that no one knows when that will be, and the community has struggled to agree on how best to move forward with the plan.

This uncertainty led to a lingering fear that a as much as a computer that can attack Bitcoin can come online before the network is ready.

In this article, we will look at the quantum threat to Bitcoin and what needs to change to make the number one blockchain ready.

How a quantum attack would work

A successful attack would not look dramatic. A thief with quantum technology would start by scanning the blockchain for any address that has ever revealed the public key. Old wallets, reused addresses, early miner results, and many inactive accounts fall into that category.

An attacker copies the public key and runs it through a quantum computer using Shor’s algorithm. It was developed in 1994 by mathematician Peter Shor algorithm it gives a quantum machine the ability to factor large numbers and solve discrete logarithm problems far more efficiently than any classical computer. Bitcoins elliptic curve signatures rely on the severity of those problems. With enough error-corrected qubits, a quantum computer could use Shor’s method to calculate the private key associated with the exposed public key.

As Justin Thaler, research partner at Andreessen Horowitz and associate professor at Georgetown University, said Decipheronce the private key is returned, the attacker can move the coins.

“What a quantum computer could do, which is relevant to Bitcoin, is to forge the digital signatures that Bitcoin uses today,” Thaler said. “Someone with a quantum computer could authorize a transaction by taking all the Bitcoins from your accounts, or whatever you want to think of it, when you didn’t authorize it. That’s a concern.”

A forged signature would look like a real one to the Bitcoin network. Nodes would accept it, miners would include it in the block, and nothing on the chain would flag the transaction as suspicious. If an attacker were to hit a large group of exposed addresses at once, then billions of dollars could be moved within minutes. Markets would start to react before anyone would ever confirm that a quantum attack was happening.

What is the situation with quantum computing in 2025?

In 2025, quantum computing finally started to seem less theoretical and more practical.

• January 2025: Google’s 105-qubit Willow the chip showed a steep reduction in error and a benchmark above classical supercomputers.
• February 2025: Microsoft released its Marjoram 1 platform and reported record entanglement of logical qubits with Atom Computing.
• April 2025: NIST extended coherence of a superconducting qubit at 0.6 milliseconds.
• June 2025: IBM set targets of 200 logical qubits by 2029 and more than 1000 in the early 2030s.
• October 2025: IBM intricate 120 qubits; Google confirmed verified quantum acceleration.
• November 2025: IBM announced a new chips and quantum edge-focused software by 2026 and fault-tolerant systems by 2029.

Why Bitcoin Became Vulnerable

Bitcoin signatures use elliptic curve cryptography. Spending from an address exposes the public key behind it, and that exposure is permanent. In Bitcoin’s early public key payment format, many addresses published their public keys on-chain even before the first spend. Later hashed public key payment formats kept the key hidden until the first use.

Because their public keys were never hidden, these oldest coins, including approximately 1 million Satoshi-era Bitcoin, are exposed to future quantum attacks. The transition to post-quantum digital signatures, Thaler said, requires active participation.

“For Satoshi to protect his coins, they would have to move them to new post-quantum secure wallets,” he said. “The biggest concern is abandoned coins, worth about $180 billion, including roughly $100 billion believed to belong to Satoshi. These are huge sums, but they’re abandoned and that’s a real risk.”

An additional risk is the coins associated with lost private keys. Many have sat untouched for over a decade, and without those keys they can never be moved to quantum-resistant wallets, making them viable targets for a future quantum computer.

No one can freeze Bitcoin directly on the chain. Practical defenses against future quantum threats focus on migrating vulnerable assets, adopting post-quantum addresses, or managing existing risks.

However, Thaler noted that post-quantum encryption and digital signature schemes have large performance costs, as they are far larger and require more resources than today’s lightweight 64-byte signatures.

“Today’s digital signatures are around 64 bytes. Post-quantum versions could be 10 to 100 times larger,” he said. “In blockchain, that size increase is a much bigger problem because each node has to store those signatures forever. Managing that cost, the literal size of the data, is far more difficult here than in other systems.”

Pathways to protection

Developers have released several suggestions for improving Bitcoin to prepare for future quantum attacks. They take different paths, from lightweight optional protections to full network migrations.

• BIP-360 (P2QRH): Creates new “bc1r…” addresses that combine today’s elliptic curve signatures with post-quantum schemes like ML-DSA or SLH-DSA. It offers hybrid security without a hard fork, but larger signatures mean larger fees.
• Quantum secure principal root: adds a hidden post-quantum branch to Taproot. If quantum attacks become realistic, miners could soft-fork to request a post-quantum branch, while users operate as normal until then.
• Address migration protocol quantum resistant (QRAMP): a mandatory migration plan that moves vulnerable UTXOs to quantum-secure addresses, possibly through a hard fork.
• Pay Taproot Hash (P2TRH): Replaces visible Taproot keys with double-hashed versions, limiting the exposure window without new cryptography or breaking compatibility.
• Non-interactive transaction compression (NTC) via STARKs: Uses knowledge-free proofs to compress large post-quantum signatures into one proof per block, reducing storage costs and fees.
• Inclusion-Disclosure Schemes: Rely on hashed commits published before any quantum threat.
  • Auxiliary UTXOs plug in small post-quantum outputs to protect consumption.
  • “Poison pill” transactions allow users to pre-announce recovery paths.
  • Fawkescoin-style variants remain dormant until a real quantum computer is demonstrated.

Taken together, these proposals outline a step-by-step path to quantum security: quick, low-impact fixes like P2TRH now, and more difficult upgrades like BIP-360 or STARK-based compression as risk grows. All of these would require broad coordination, and many post-quantum address formats and signature schemes are still in the early stages of discussion.

Thaler noted that Bitcoin’s decentralization — its greatest strength — also makes major upgrades slow and difficult, since any new signature scheme would require broad agreement between miners, developers and users.

“Two main problems stand out for Bitcoin. First, upgrades take a long time, if at all. Second, there are abandoned coins. Any migration to post-quantum signatures has to be active, and the owners of those old wallets are gone,” Thaler said. “The community has to decide what happens to them: either agree to remove them from circulation or do nothing and let quantum-wielding attackers take them. That second path would be legally gray, and those who would confiscate the coins probably wouldn’t care.”

Most Bitcoin owners do not need to do anything right away. Several habits go a long way in reducing long-term risk, including avoiding reusing addresses to keep your public key hidden until you spend and sticking to modern wallet formats.

Today’s quantum computers are nowhere close to cracking Bitcoin, and predictions of when they will be vary wildly. Some researchers see a threat in the following five yearsothers push him into 2030sbut continued investments could speed up the timeline.