Q-Day Cryptocurrency Timeline: When Quantum Computers Will Threaten Crypto

TL;DR: Q-Day is the term for the moment a fault-tolerant quantum computer first breaks public-key cryptography at scale. For cryptocurrency, it means Bitcoin, Ethereum, Solana, Cardano, and most other chains become vulnerable to private key theft. Current research estimates Q-Day for 2030-2035, with significant uncertainty in both directions. NIST has already published post-quantum standards (FIPS 203, 204, 205) to prepare. Most major blockchains do not yet have post-quantum signatures deployed. The harvest-now-decrypt-later threat means some exposure has already begun.

What Is Q-Day for Cryptocurrency?

Q-Day (Quantum Day) refers to the point when a fault-tolerant quantum computer becomes capable of breaking the public-key cryptography that secures cryptocurrency wallets. For most blockchains, this means running Shor's algorithm fast enough to derive a private key from its on-chain public key within a useful window of time, typically hours to days. On Q-Day, any cryptocurrency address whose public key is visible on the blockchain becomes drainable by whoever controls the quantum computer. Estimates for Q-Day range from 2030 to 2035, but the uncertainty is high in both directions.

Q-Day is not a sudden switch. It is better understood as a threshold crossing: the point when quantum hardware reaches sufficient scale and fidelity to execute Shor's algorithm on 256-bit elliptic curves within a practical time frame. Hardware progress toward this threshold has been accelerating: IBM reached 100+ qubit processors in 2023, Google's Willow chip achieved below-threshold error rates for the first time in 2024, and Microsoft's Majorana 1 chip claimed a topological qubit milestone in early 2025. None of these are cryptographically relevant yet, but they represent measurable progress on the path to fault-tolerant quantum computing.

The Q-Day Timeline: What Current Research Says

The most-cited technical estimate for Q-Day comes from Webber et al. (2022, Nature Physics), which calculated that breaking secp256k1 (the Bitcoin and Ethereum signature curve) in one hour would require approximately 317 million physical qubits, and in one day approximately 13 million physical qubits. Current largest processors have a few thousand physical qubits. The gap between current hardware and the Q-Day threshold is roughly 3-4 orders of magnitude in qubit count, plus requirements for much higher gate fidelity and robust error correction. Most credible expert estimates place Q-Day between 2030 and 2035.

Several factors make the exact timeline difficult to predict:

• Qubit quality vs quantity. Raw qubit count is not the only relevant metric. Gate fidelity (the accuracy of quantum operations), coherence time (how long a qubit maintains its state), and error correction overhead all determine when a quantum computer is cryptographically capable. IBM Heron R2 achieved 99.9% two-qubit gate fidelity in 2025, which is required for viable error correction but still short of the sustained, scalable performance needed for Shor's algorithm at cryptographic scale.
• Algorithmic improvements. Shor's algorithm has been refined since its original publication. More efficient circuit implementations reduce the qubit count required. Future algorithmic improvements could lower the threshold further. The Webber et al. figures are upper bounds; real-world Q-Day may arrive earlier than those estimates suggest.
• Classified progress. National intelligence agencies (NSA, GCHQ, Chinese intelligence services) may have access to quantum computing research that is not publicly available. The NSA's 2022 CNSA 2.0 directive mandating post-quantum cryptography for all national security systems by 2033 is consistent with classified knowledge of an aggressive timeline.

What Happens to Cryptocurrency on Q-Day

On Q-Day, any on-chain public key becomes a liability. Bitcoin addresses that have sent transactions, Ethereum EOAs with activity, Solana wallets that have signed transactions, and Cardano addresses that have spent UTXOs all have permanently on-chain public keys. A quantum computer could derive the private keys for all of these simultaneously. The most vulnerable addresses are those holding large balances with exposed public keys: early Bitcoin addresses from the pre-2012 era, exchange hot wallets, and DeFi protocol governance keys all fit this profile. The result would be a race to drain exposed wallets before the attacked addresses can move their funds to safer configurations.

The economic impact of Q-Day on cryptocurrency would unfold in stages:

• Pre-announcement (T-minus unknown): A nation-state or well-funded actor achieves Q-Day capability quietly. They begin systematic harvesting of high-value wallet private keys. Large, exposed wallets start draining to attacker-controlled addresses. This might look like a series of large unexplained transfers before anyone understands what is happening.
• Public recognition: Either the attacker reveals themselves (through demands, announcements, or the scale of the theft), or security researchers detect the pattern of exploits. At this point, all cryptocurrency markets reprice the Q-Day risk simultaneously. Chains without post-quantum migrations may see sharp price dislocations as holders attempt to move funds to safer configurations.
• Chain response: Blockchains that have deployed post-quantum signatures can activate migration tools. Chains without post-quantum signatures face a more difficult path: they need to implement and activate a hard fork under time pressure while the network is under active attack. The difficulty of coordinating a hard fork in a decentralized system is well documented.

The Harvest-Now-Decrypt-Later Threat Is Already Active

Harvest-now-decrypt-later (HNDL) is an attack strategy where an adversary records encrypted communications or blockchain transactions today, stores them, and decrypts them after Q-Day using a future quantum computer. For cryptocurrency, this means on-chain public keys are already being catalogued by sophisticated adversaries. The Bitcoin blockchain since 2009 is a complete public record of every address that has ever sent a transaction, along with its Ed25519 or secp256k1 public key. Adversaries with long time horizons (nation-states, intelligence agencies) have years to prepare for Q-Day while the data is already available.

HNDL is not theoretical. The NSA's CNSA 2.0 framework explicitly acknowledges this threat, which is why it mandated post-quantum cryptography for national security communications starting in 2025, well before Q-Day is expected to arrive. Cryptocurrency infrastructure that handles sensitive key material faces the same HNDL exposure as classified communications.

NIST Post-Quantum Standards: What Was Published and When

NIST published its first three post-quantum cryptography standards in August 2024:

• FIPS 203 (ML-KEM): Lattice-based key encapsulation mechanism, derived from Kyber. Replaces RSA and ECDH for key exchange. Primary standard for protecting data in transit.
• FIPS 204 (ML-DSA): Lattice-based digital signature, derived from CRYSTALS-Dilithium. Replaces ECDSA and Ed25519 for authentication and signing. This is the signature standard relevant to blockchain transaction signing.
• FIPS 205 (SLH-DSA): Hash-based digital signature, derived from SPHINCS+. Conservative backup option based on hash function security rather than lattice assumptions. Larger signatures but different mathematical foundation from ML-DSA.

These are not draft standards. They are final FIPS publications. Software and hardware vendors are required to support them for federal government use. Their publication marks the point at which post-quantum migration from classical algorithms is officially standardized and supported. Blockchains that integrate ML-DSA and SLH-DSA are using the same standards that the US government, financial regulators, and major technology companies are adopting.

Which Cryptocurrencies Are at Greatest Risk on Q-Day

Not all cryptocurrencies are equally exposed on Q-Day. Risk is proportional to the amount of on-chain public key exposure combined with the lack of a deployed post-quantum migration:

• Bitcoin (highest risk from historical exposure): Early Bitcoin from 2009-2012 used pay-to-public-key (P2PK) outputs, which store the full public key directly in the UTXO. Approximately 1 million BTC attributed to the Satoshi-era is in P2PK UTXOs. Additionally, P2PKH addresses (the standard format since 2012) have their public key revealed once spent. The total Bitcoin exposure from spent P2PKH addresses represents the majority of circulating supply. See the Bitcoin quantum safety guide for the full exposure analysis.
• Ethereum (high risk, broad DeFi surface): Virtually all Ethereum DeFi activity requires transaction signing, which exposes the user's secp256k1 public key. DeFi users who have been active since 2020 have years of key exposure across multiple protocols. Ethereum's 900,000+ validator set adds BLS12-381 exposure. See the Ethereum quantum safety guide.
• Solana (high risk, high transaction rate): Solana's high transaction throughput means active Solana wallets accumulate public key exposure faster than wallets on slower chains. See the Solana quantum safety guide.
• Cardano (moderate risk, eUTXO advantage): The eUTXO model gives Cardano users more control over their public key exposure, but any spent address is vulnerable. See the Cardano quantum resistance guide.

What Cryptocurrency Holders Should Do Before Q-Day

The most important action is to understand your personal Q-Day exposure now, before it becomes urgent. Key steps:

• Identify your exposed addresses. Any cryptocurrency address that has signed an outgoing transaction has its public key on-chain. For each chain you use, determine which of your addresses have transaction history and how much value sits at those addresses.
• Follow post-quantum migration announcements. Bitcoin's BIP-360 (P2QRH), Ethereum's Splurge roadmap, and Solana's developer community are the primary sources for base-layer migration news. When post-quantum address formats become available on your chain, plan to migrate early.
• Model your timeline risk. Use the Quantum Threat Calculator to understand at what point your holdings face material risk based on quantum computing progress projections.
• Consider native post-quantum alternatives. Chains that implement quantum-resistant signatures from genesis, rather than via future hard forks, provide protection today without waiting for base-layer migrations. The post-quantum key management guide covers what those architectures look like in practice.

Q-Day is not certain to arrive in 2030, and it may not arrive exactly as described above. But the cost of preparing early is small relative to the cost of being caught unprepared. The NIST standards are published. The migration tooling is being built. The remaining variable is when to start.