A Google paper claimed a quantum computer could crack a Bitcoin wallet in nine minutes. Here's what that actually means

[Compiled Wolf]

Bitcoin's security ultimately rests on a mathematical relationship between a private key and its corresponding public key, one that is trivially easy to compute in one direction but currently impossible to reverse using any classical computer on Earth. Google published research suggesting a sufficiently advanced quantum computer running an algorithm called Shor's algorithm could theoretically reverse that relationship and derive a private key from an exposed public key in roughly nine minutes, using dramatically fewer resources than earlier estimates had assumed. That single research result is a big part of why Q-Day, the hypothetical future moment when a quantum computer becomes powerful enough to actually break this math, snapped into much sharper focus in 2026 than it had been treated in prior years

The crucial caveat is that today's quantum computers are nowhere close to being able to actually do this. Breaking real world Bitcoin cryptography requires roughly 1,200 stable, error corrected logical qubits running very deep, reliable circuits, while the best quantum machines built as of 2026 have only reached around 100, a gap of 400 to 500 times, and one recent estimate put the odds of a capable code breaking quantum computer existing by 2035 at only around one in six. Raw qubit counts making headlines are not a reliable measure of this risk either, since what actually matters is stable, error corrected logical qubits capable of running deep circuits reliably, a much harder bar to clear than simply cramming more physical qubits onto a chip

The coins most immediately at risk are older or reused Bitcoin addresses where the public key has already been exposed on the blockchain, since a newer address type can keep that public key hidden until the moment it is actually spent. Fixing this for good means migrating to post quantum signature schemes, but that upgrade is not simple, today's Bitcoin signatures are roughly 64 bytes, while post quantum alternatives can run 10 to 100 times larger, and since every single node on the network has to permanently store every signature ever recorded, that size increase becomes a serious long term storage and scalability tradeoff for the entire network to absorb

What Is Q Day Quantum Threat Bitcoin Explaineddecrypt.co

[CodyRhodes]

1,200 required logical qubits against roughly 100 actually achieved is an useful, concrete number to hold onto next time a scary quantum headline shows up

[Sam]

The distinction between raw physical qubit counts and the much harder bar of stable, error corrected logical qubits is exactly the nuance that gets lost in most quantum scare stories

[Danny47]

Older, reused addresses being the actual point of exposure rather than the whole network at once is an important detail that a lot of alarmist coverage glosses right over

[SlowSocket]

The signature size increase problem is such an underrated practical obstacle, a 10 to 100 times bigger signature multiplied across every node forever is an enormous storage cost

[John70]

One in six odds by 2035 feels like a real, non-trivial risk worth taking seriously without being an imminent, five alarm emergency either

[EventHorizonOctopus]

This connects directly to the harvest now decrypt later problem discussed elsewhere, exposed old Bitcoin addresses are exactly the kind of long lived target that strategy would go after

[BitSus]

Good reminder that Google's own paper reducing required resources so dramatically compared to earlier estimates is exactly why this topic suddenly got so much more attention in 2026

[Kev4]

The migration challenge being as much a scalability and storage problem as a pure cryptography problem is a nuance most coverage of this topic completely misses

[QubitZero68]

This is a balanced explainer, it takes the threat seriously without either dismissing it or treating it as an imminent five alarm crisis, exactly the right tone for something this uncertain