Q-Day is no longer a twenty year problem. Here is what the latest research actually says about how close we are. - help needed

[SpinState]

Something shifted in the first quarter of 2026 and it happened fast enough that most mainstream coverage has not caught up with it. Three significant research papers landed between January and March, and taken together they have compressed the expert consensus on Q-Day, the moment a quantum computer can break the encryption protecting the internet, from a vague distant horizon into a concrete planning crisis with a worst case that some researchers now put at three years from today.

The paper that caused the most alarm came from Google's Quantum AI Lab on March 25th. Their researchers showed that elliptic curve cryptography, the system protecting Bitcoin, Ethereum, most VPN connections, and a significant portion of internet traffic, could be broken using approximately 500,000 physical qubits. That sounds large until you understand the context. Previous estimates for breaking ECC put the requirement at roughly ten million physical qubits. Google's new analysis represents a twenty-fold reduction in the resources required. On the same day, a Caltech startup called Oratomic, founded by researchers who previously worked at Google, Harvard, and Berkeley, published concurrent research suggesting P-256 elliptic curve cryptography could be broken with as few as 10,000 qubits using neutral atom architecture. The Oratomic team was explicit that AI-assisted algorithm discovery was part of what enabled the result, and that a follow-up paper detailing that methodology is coming. Cloudflare's cryptography researcher Bas Westerbaan described the Oratomic figure as shockingly low.

The Global Risk Institute's seventh Quantum Threat Timeline Report, published March 9th by Michelle Mosca and co-authored with input from 26 experts, assessed a cryptographically relevant quantum computer as quite possible within ten years and likely within fifteen. That report predates the Google and Oratomic papers. The GQI has since updated its assessment to include a reasonable worst case of three years from today for ECC-256 attacks, specifically for offline or retrospective decryption of previously captured data rather than real-time interception. These are different threat models and the distinction matters. The worst case is not the most likely case. The most likely estimate from GQI remains 2032 for ECC Q-Day. But the worst case moving from twenty years to three is the thing that should be impossible to ignore.

What does this mean practically in the next two years specifically. First, the harvest now decrypt later threat is already active regardless of when Q-Day arrives. State actors with the resources and motivation to store encrypted traffic today are almost certainly doing so. Any data that was encrypted using ECC and transmitted over a network should be considered potentially compromised in the future if it falls into the hands of a well-resourced adversary. Second, the compliance pressure is real and arriving fast. NSA's CNSA 2.0 framework mandates all new US national security systems be quantum-safe by January 2027, which is seven months away. NIST finalised its post-quantum cryptographic standards in August 2024 and its deprecation timeline calls for vulnerable algorithms to be deprecated after 2030. Google has set an internal 2029 deadline for its own full PQC migration and has shared its methodology publicly. The signal from the organisations who know the most about the threat is consistent and the direction is the same: the window for orderly migration is open now and will not stay open indefinitely. The question for individuals and organisations is not whether to migrate but how fast.

Q-Day Just Got Closer: Three Papers in Three Months Are Rewriting the Quantum Threat Timelinethequantuminsider.com

[Maxximus]

The twenty-fold reduction in resource requirements is the number that needs to be in every board meeting that covers technology risk. The entire threat model changed in a single quarter and most executives have not heard about it

[DeepInlet]

The distinction between real-time interception and retrospective offline decryption is the part most coverage gets wrong. The worst case three year figure is for retrospective attacks on already captured data, not for someone cracking your current live session. Both matter but differently

[SuperPosition]

Cloudflare calling the Oratomic figure shockingly low is the tell. Westerbaan runs cryptography at a company that secures a meaningful fraction of the internet and he does not use that language casually

[Gareth5]

The AI-assisted algorithm discovery element is the loop that genuinely concerns me. AI is being used to find more efficient quantum algorithms faster than humans could derive them. That feedback loop has no obvious ceiling and the Oratomic team is explicit that a follow-up paper on the AI methodology is coming

[Craig]

Worth being precise about the 10,000 qubit figure. Oratomic is talking about 10,000 high quality neutral atom qubits with very low error rates. That is not 10,000 of the noisy qubits that exist today. The gap between that figure and current hardware is still significant

[StuckOnDestiny]

Fair but the gap is closing faster than anyone expected. The ETH Zurich neutral atom swap gate paper from this month is part of the same trajectory. The hardware is being pulled forward by the algorithm work and the algorithm work is being pulled forward by the hardware. Both are accelerating

[Jason99]

The harvest now decrypt later framing is the one I use with clients who say this is a future problem. The attack is present tense even though the capability is future tense. Data encrypted today using ECC can be stored and decrypted later. That is not a thought experiment, it is an operational assumption for any well-resourced state actor

[QuantumToken98]

Seven months to the NSA CNSA 2.0 deadline for new national security systems is the specific number I keep returning to. That is not a theoretical policy horizon. That is a procurement and deployment deadline that is already inside most enterprise planning cycles

[Sigma]

The migration timeline math from the byteiota analysis is the uncomfortable part. Large enterprises starting migration in 2026 complete between 2038 and 2041. GQI's likely Q-Day is 2032 to 2036. The overlap is where the risk lives

[Highland Dylan]

Google setting a 2029 internal deadline while simultaneously publishing the research that makes that deadline feel urgent is either the most responsible thing a major tech company has done in years or the most effective piece of self-interested standards setting. Probably both

[PaleCipher]

Satoshi's original Bitcoin wallets from 2009 and 2010 that have never moved are the most exposed assets in the world to this specific threat. Those addresses have exposed public keys on chain. If a capable quantum computer arrives before those coins move the keys are broken before the owner can respond

[Golden Dan]

The Starknet founder calling for acceleration of BIP-360 is the right response from the cryptocurrency community but the governance challenge of getting Bitcoin to upgrade its signature scheme is enormous. The technical path exists. The social consensus is harder than the engineering

[DarkMatter23]

2026 being designated the Year of Quantum Security by FBI, NIST, and CISA simultaneously is not a coincidence. The intelligence community knows something about the threat timeline that the public does not and the policy response is moving faster than the public explanation

[ProperMadlad20]

The most likely scenario from postquantum.com is a gradual erosion of trust rather than a single Q-Day event. A cryptographically relevant quantum computer would initially be a classified national security asset, not a public announcement. We would not know Q-Day had happened until months or years later when the consequences became visible

[Midnight Georgia]

That erosion of trust scenario is the one that keeps cryptographers awake. It is not the data breach that is the catastrophe. It is the moment when it becomes widely suspected that a capable machine exists and confidence in everything signed or encrypted before the transition collapses simultaneously