The headline risk isn't that a quantum computer is about to steal Bitcoin. It's that the industry just agreed, for the first time, on a calendar: a nine-company alliance now points to early 2028 as a plausible window for a machine that could break the cryptography protecting roughly 6.4 million bitcoin, and almost nobody agrees on what to do before then.
Key takeaways
- Google's Willow chip cut quantum error rates roughly 40-fold while preparing "magic states," a step toward the kind of machine that could eventually run Shor's algorithm against Bitcoin's keys, according to a paper published in Science and reported October 15-16, 2026.
- A new nine-member Quantum Alliance, launched October 15, 2026 in Lisbon, estimates that 6.04 to 6.4 million bitcoin, about 30% of the supply, have public keys already exposed on-chain, including roughly 1.1 million tied to Satoshi Nakamoto's earliest addresses.
- No existing quantum computer can break this cryptography today. A "Quantum Doom Clock" built by two of the alliance's own members pegs March 2028 as an early possible date, assuming about 856,000 physical qubits; other researchers put the real danger in the 2030s.
- The alliance's own members are split on whether exposed coins should eventually be frozen, migrated into a recovery trust, or left alone, a fight over Bitcoin's "no one can seize your coins" promise that has nothing to do with quantum physics.
A 40-Fold Error Cut Doesn't Make Bitcoin's Keys 40 Times Weaker
Google reported that its Willow chip cut errors by roughly 40-fold while preparing "magic states," a specialized resource that quantum computers need to run certain advanced calculations, in a paper published in the journal Science and covered October 15-16, 2026. States that passed Google's error-checking process, a method called cultivation, reached about 99.99% fidelity. The catch: only about 8% of attempts survived that filtering, so the headline improvement sits inside a process that still throws away most of its own output.
That nuance matters because of how the result is being used. Bitcoin's security against a quantum attacker comes down to Shor's algorithm, the method mathematician Peter Shor published in 1994 showing that a sufficiently powerful quantum computer could, in theory, derive a private key from its matching public key. Willow is a step toward the hardware such an algorithm would need, not a demonstration against Bitcoin itself. Coverage of the breakthrough is explicit that the 40-fold error cut does not simply divide Google's earlier qubit estimate by 40, because that March 2026 estimate, which put the bar at fewer than 500,000 physical qubits for one modeled attack, already assumed efficient magic-state production. Willow improves the "how," not the "how many."
Advertisement
Satoshi's Coins Are the Canary, Not the Only Target
The reason this story is about old bitcoin specifically, rather than crypto in general, is a quirk of how early transactions worked. Spending a modern bitcoin typically reveals a public key only at the moment of the spend, and many wallets hide it behind a hash until then. Some of Bitcoin's oldest holdings skip that protection, exposing their public keys the moment coins were received. The Quantum Alliance estimates that 6.04 to 6.4 million bitcoin, roughly 30% of the entire supply, fall into this exposed category, including an estimated 1.1 million bitcoin tied to Satoshi Nakamoto's earliest addresses.
None of this is an active threat yet. Every source covering the alliance's launch is explicit that no existing quantum computer is powerful enough to break this cryptography today. What's changed is that old coins have started moving again: 100.02 bitcoin dormant since July 2010 moved on October 7, 2026, worth about $8.5 million at the time, and six wallets inactive since 2011-2014 moved 553.59 bitcoin in August 2026, worth roughly $40 million. Reporting on those transfers notes they don't prove the owners are reacting to quantum fears, but they're exactly the kind of exposed, dormant coins the alliance is worried about.
Nine Companies Set the Agenda, and None of Them Run Bitcoin's Protocol
The Quantum Alliance that launched October 15, 2026 in Lisbon counts nine members: Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian, The Vault and Hacken. Its stated plan is narrower than "fix Bitcoin": publish shared standards for assessing whether blockchains are ready for quantum attacks, focused on four areas (migrating vulnerable funds, evaluating privacy technology, protecting wallets, and keeping security tools interoperable across chains), using an open process the group compares to the Internet Engineering Task Force. It says it won't build a new blockchain.
What's notable is who isn't on that list. The roster is quantum-security vendors, a privacy-chain foundation and layer-1 projects, not Bitcoin Core, the loosely organized group of volunteer developers who maintain Bitcoin's reference software. Quantus CEO Christopher Smith framed the stakes bluntly: "In the future, 'post-quantum cryptography' will just be called 'cryptography' and everything else will be in a museum." He's also warned that whoever builds the first cryptographically relevant quantum computer could simply take exposed coins first, possibly with a government behind them. That's a real incentive problem, but it's also a pitch for the alliance's own relevance, since companies selling quantum-resistant infrastructure benefit from urgency, even though any fix still has to run through Bitcoin's famously conservative governance process.
Advertisement
The Real Fight Is Over Seizing Coins, Not Over Physics
The sharpest disagreement inside the alliance isn't technical, it's about property rights. Richard Carback, chief technology officer at Postquant Labs, prefers migrating vulnerable coins rather than freezing them, proposing a trust structure that would let owners who can prove ownership recover funds later. Bryn Bennett, chief revenue officer at The Vault, argues the opposite: freezing coins is a decision for Bitcoin's own network governance, not an outside industry group, and doing it anyway would set a precedent against the property-rights and neutrality guarantees that make Bitcoin valuable. Separately, Changpeng Zhao has suggested freezing Satoshi's roughly 1.1 million bitcoin if they remain untouched, and Jameson Lopp has floated restrictions on vulnerable coins more broadly.
✦ Free Newsletter ✦
Never miss a story
Tools, tutorials and AI deep-dives - straight to your inbox, every week.
That split matters because any fix to Bitcoin's signature scheme needs buy-in from developers, miners, wallet providers, exchanges and ordinary users, the same kind of broad consensus that makes Bitcoin slow to change by design, as explored in our look at how different blockchains reach agreement on security rules. New quantum-resistant signatures also tend to take up more block space, which could mean higher fees once a migration happens. Deciding who gets to touch 6.4 million exposed coins, and on whose timeline, is a governance problem dressed up as a cryptography problem.
What "March 2028" Actually Means, and Why It's Probably Not That
The most concrete number in this story is also the shakiest. The "Quantum Doom Clock," built by Postquant Labs co-founders Richard T. Carback III and Colton Dillion, two members of the very alliance pushing for action, estimates that a machine with roughly 856,000 physical qubits could arrive as early as March 2028. The article introducing that figure is explicit that it is not a prediction of an inevitable attack, and other researchers quoted in the same coverage think the real danger window sits in the 2030s instead. Google's own March 2026 estimate, by contrast, put the bar at fewer than 500,000 physical qubits for a different modeled scenario, a reminder that these numbers shift depending on who's modeling the attack and what assumptions they bake in.
| Estimate | Source | Qubits assumed | Earliest window cited |
|---|---|---|---|
| Quantum Doom Clock | Postquant Labs co-founders | ~856,000 physical qubits | March 2028 |
| Modeled attack scenario | Google, March 2026 estimate | Fewer than 500,000 physical qubits | No date given |
| Broader expert view | Researchers cited alongside the Doom Clock | Not specified | 2030s |
The honest read of that table is that nobody actually knows, and the people with the most specific date also sell quantum-resistant security products. That doesn't make them wrong; the cryptographic risk to exposed public keys is real and well understood. But a specific calendar date is doing a lot of marketing work for an industry that benefits from urgency, and the gap between "fewer than 500,000 qubits" and "856,000 qubits" in estimates published roughly six months apart shows how unstable these projections still are.
Advertisement
Who Should Actually Care, and What to Do About It
This matters most to a narrow group: anyone holding bitcoin in addresses that have already revealed a public key, generally coins received to very old address formats, or coins in any address spent from before (reusing an address re-exposes its public key). It matters far less to typical holders using modern, unused addresses, since those public keys stay hidden until the owner spends.
- If you hold coins in an address created before 2012 that has never moved, check whether it's a pay-to-public-key format; those expose keys by default.
- If you've ever reused a bitcoin address for multiple deposits, treat its public key as exposed and plan to migrate funds to a fresh address eventually, not urgently.
- If your coins sit in a modern wallet with addresses you've never spent from, this specific threat does not apply to you yet, and panic-moving funds now mainly just adds transaction fees and new scam exposure.
- Everyone, regardless of exposure, benefits more right now from basic wallet hygiene than from quantum speculation; our breakdown of how crypto wallet drainers actually steal funds today covers the risk that's actually active.
Skip the anxiety if you're a casual holder with coins in a standard modern wallet you've never reused; the realistic timeline, even on the alliance's own aggressive estimate, is years out, and the mechanics of any Bitcoin-wide migration would be announced and debated for a long time before it mattered to you.
No existing quantum computer is powerful enough to execute this kind of attack today, according to the Quantum Alliance's own October 2026 estimates, even as it frames 6.4 million exposed bitcoin as the reason its standards work can't wait.
Advertisement
The takeaway isn't "Bitcoin is about to break." It's that an industry with a financial stake in quantum-resistant cryptography has, for the first time, put a specific number of exposed coins and a specific early date on the table, and Bitcoin's own decentralized governance now has to decide, slowly and in public, whether that's a five-alarm fire or a useful nudge to fix a known weakness on a sane timeline. Watch what Bitcoin Core contributors, not the alliance, say next; they're the ones who'd actually have to write and ship any fix, and their absence from this launch is the detail worth tracking.
Sources
Advertisement
