Google Quantum AI published results in *Science* on October 15 showing its 105-qubit Willow processor can produce fault-tolerant "magic states" at 99.99% logical fidelity — a 40-fold error reduction over prior methods. The demonstration addresses a bottleneck that, by some estimates, would have c...
"We're not saying Q-day is imminent. We're saying 6 million bitcoin have their public keys sitting on-chain, and the window to fix that is finite." — Hunter Beast, Quantum Alliance co-founder
Google Quantum AI published results in Science on October 15 showing its 105-qubit Willow processor can produce fault-tolerant "magic states" at 99.99% logical fidelity — a 40-fold error reduction over prior methods. The demonstration addresses a bottleneck that, by some estimates, would have consumed 90–95% of a quantum computer's physical qubit capacity, clearing a path toward the fault-tolerant machines the company targets by 2029.
The same week, nine blockchain organizations launched the Quantum Alliance in Lisbon, estimating that 6.04–6.4 million BTC (roughly 30% of circulating supply) sit in addresses whose public keys are permanently exposed on-chain. The alliance's internal model pegs the earliest threat window at approximately 856,000 physical qubits — a threshold it projects could arrive by March 2028, roughly 800× beyond current hardware capability. Coinbase, which custodies approximately 5% of all bitcoin, simultaneously published a protocol position paper urging an immediate start to Bitcoin's post-quantum signature migration.
The convergence of these events in a single week marks the most concentrated period of quantum-related activity the crypto industry has seen.
Google Quantum AI's paper, authored by Craig Gidney, Noah Shutty, Cody Jones, and colleagues, demonstrates a technique called magic state cultivation on the Willow superconducting processor. The experiment used 54 of Willow's 105 physical qubits.
What it solves. Fault-tolerant quantum computing requires non-Clifford T-gates to perform universal computation. Generating the resource states (T-states) for these gates through traditional distillation protocols was projected to consume 90–95% of a quantum computer's physical qubit footprint. Cultivation replaces distillation with a smaller, more efficient process: a noisy quantum state is injected into a small region of qubits encoded in interactive color codes, coordinated measurements detect and discard faulty preparations, and surviving states are grafted into surface codes.
The numbers. The team reports T-state logical fidelity of 99.99(1)%, a 40× error reduction over uncultivated states, with an 8% yield rate (i.e., 8% of attempts pass quality checks). The technique runs entirely within the existing Willow chip architecture, requiring no additional hardware.
What it does not solve. The experiment demonstrates cultivation on a 105-qubit device. Breaking elliptic-curve cryptography — the signature scheme securing Bitcoin, Ethereum, and most blockchain networks — requires on the order of 500,000 to several million physical qubits, according to a March 2026 paper co-authored by Google Quantum AI researchers, the Ethereum Foundation, and Stanford University. Google's own roadmap targets a "useful, error-corrected quantum computer" by 2029, but CEO Sundar Pichai has acknowledged this likely requires on the order of one million physical qubits.
Blockchain networks rely on elliptic-curve cryptography (ECC) — specifically secp256k1 for Bitcoin and secp256k1/BN254 for Ethereum — to derive public keys from private keys. The security assumption is that reversing this derivation is computationally infeasible on classical hardware. Shor's algorithm, running on a sufficiently powerful quantum computer, would collapse that assumption.
Bitcoin's specific vulnerability. Not all Bitcoin addresses are equally exposed. Addresses using the legacy Pay-to-Public-Key (P2PK) format broadcast the raw public key on-chain, giving a quantum attacker an indefinite window to derive the private key. According to the Quantum Alliance's analysis, 6.04–6.4 million BTC sit in addresses with exposed public keys, including an estimated 1.1 million BTC linked to Satoshi Nakamoto's early mining addresses. At current prices, the exposed supply represents hundreds of billions of dollars in value.
Modern Bitcoin address formats (P2PKH, P2SH, P2WPKH, P2TR) hash the public key, exposing it only during a spend transaction. This narrows the attack window but does not eliminate it — a quantum-capable adversary could intercept the broadcast transaction and derive the private key before the transaction confirms.
Ethereum's exposure. Ethereum accounts use a single persistent public key, making all ETH and ERC-20 balances in standard externally owned accounts (EOAs) theoretically vulnerable once a sufficiently powerful quantum computer exists. The March 2026 Google/Ethereum Foundation/Stanford paper estimated that Bitcoin's secp256k1 curve could be broken with fewer than 500,000 physical qubits.
Quantum Alliance. Nine organizations — Quantus, American Fortress, Intmax, Keystone, Midnight Foundation, Postquant Labs, Abelian, The Vault, and Hacken — launched the Quantum Alliance on October 15 in Lisbon. The group does not issue a new blockchain. Instead, it publishes open testing and migration guidelines modeled after IETF standards, organized across four workstreams: network migration, post-quantum zero-knowledge systems, wallet security, and cross-chain compatibility.
The alliance maintains a "Quantum Doomsday Clock" pegging the earliest threat window at approximately 856,000 physical qubits, which it projects could be reached by March 2028. Current leading quantum processors — Google's Willow (105 qubits), IBM's Heron (156 qubits) — operate at roughly 0.01–0.02% of that threshold. The alliance's critics note that most founding members are altcoin projects, not Bitcoin Core contributors.
Coinbase's position paper. Published October 13, Coinbase's paper calls for Bitcoin to begin its post-quantum transition immediately. The exchange, which custodies approximately 5% of all bitcoin, recommends: decoupling the output container from the signature scheme via BIP-360 or P2TRv2; supporting hybrid wallets holding both classical and quantum-resistant signature paths; and evaluating candidate schemes including ML-DSA (CRYSTALS-Dilithium), SLH-DSA, FN-DSA, and SPHINCS+. Coinbase disclosed it is developing a post-quantum version of its proprietary key management system and reviewing internal systems that rely on ECC.
BIP-360, also known as "QuBit — Pay to Quantum Resistant Hash," was merged into the official BIP repository as a draft soft-fork proposal in February 2026.
Technical design. BIP-360 introduces Pay-to-Merkle-Root (P2MR), a Taproot-like script-tree output that removes the quantum-vulnerable key-path spend. To spend a P2MR output, the user must satisfy a Tapscript condition through the script path, which can include post-quantum signature verification opcodes rather than the classical Schnorr signatures that Taproot's key path uses.
What BIP-360 does not do. The current proposal deliberately does not select a post-quantum signature scheme, leaving that decision to a future consensus proposal. It also does not protect ordinary elliptic-curve spends from short-exposure attacks. A working testnet from BTQ Technologies has been producing quantum-resistant transactions since March 2026, and the July 24, 2026 revision added Python implementation examples and updated test vectors.
Migration challenge. Even if BIP-360 activates, the 6+ million BTC in exposed P2PK addresses cannot be migrated without their owners' cooperation. If those keys are lost — as is widely assumed for Satoshi's estimated 1.1 million BTC — those coins remain permanently vulnerable.
Ethereum's post-quantum roadmap follows a different architecture. EIP-8141, slated for consideration in the Hegotá upgrade in the second half of 2026, introduces signature agility — allowing users and wallet providers to voluntarily upgrade individual accounts to post-quantum signature schemes through account abstraction, independent of a network-wide transition.
Validator signatures. For the consensus layer, Ethereum is prototyping leanXMSS, a hash-based scheme, paired with a minimal zkVM called leanVM that compresses larger post-quantum signatures by approximately 250× to maintain aggregation efficiency.
Timeline. According to the Ethereum Foundation, best-case mainnet deployment of post-quantum signatures is 2028–2030, with full migration expected to take years beyond that. The account abstraction approach means individual high-value accounts can migrate before the network-wide upgrade.
Other chains. Solana developers are building dual keypairs (Ed25519 plus Dilithium) for high-value wallets. Firedancer, Jump Crypto's alternative validator client shipping in 2026, already supports multiple signature backends. Two layer-1 chains — SynergyX and QRL — run NIST-approved post-quantum cryptography at genesis.
The gap between current quantum hardware and the threshold for breaking ECC remains large. Quantitative estimates vary widely:
| Metric | Current State | Threat Threshold | Gap | |--------|--------------|-------------------|-----| | Physical qubits (Google Willow) | 105 | ~500,000–4,000,000 | ~5,000–38,000× | | Physical qubits (IBM Heron) | 156 | ~500,000–4,000,000 | ~3,200–25,600× | | Logical qubit requirement | N/A | ~1,200–2,330 | N/A | | Quantum Alliance threshold | N/A | ~856,000 | ~8,150× vs. Willow |
Google's internal target is a useful, error-corrected quantum computer by 2029. NIST's deprecation timeline targets phasing out quantum-vulnerable algorithms by 2035. The Quantum Alliance projects the earliest possible threat at March 2028, though this is contingent on exponential scaling that has not yet been demonstrated.
Expert consensus, per the March 2026 Google/Ethereum Foundation/Stanford paper, is that the threat is not imminent but that migration timelines for decentralized networks — which require broad consensus and cannot be updated by executive decree — make early preparation necessary. Blockchain upgrades that took 2–4 years in past soft-fork cycles (SegWit, Taproot) serve as a baseline for migration planning.
The financial exposure is substantial. NIST's framework identifies $3 trillion in digital assets protected by quantum-vulnerable elliptic-curve cryptography. The Quantum Alliance's narrower estimate of 6.04–6.4 million BTC with exposed public keys represents, at recent prices, a significant fraction of Bitcoin's total market capitalization.
Beyond direct theft risk, a credible quantum threat could trigger market repricing well before an actual break occurs. The "harvest now, decrypt later" attack vector — where adversaries collect encrypted data today for future decryption — applies directly to blockchain transactions that expose public keys on-chain.
For institutional custodians, the migration timeline creates operational risk. Coinbase, which manages billions in customer assets, has begun internal post-quantum key management development. NIST's Executive Order 14412 mandates accelerated federal PQC migration for government systems, and the Federal Acquisition Regulatory Council will require contractor compliance with NIST PQC standards, potentially affecting any crypto custodian serving government-adjacent clients.
The week of October 13–17, 2026 produced three concurrent quantum-crypto developments: a peer-reviewed hardware breakthrough, an industry coalition launch, and a major custodian's formal migration call. None of these events independently alter the threat timeline. Google's cultivation technique is a resource-efficiency improvement, not a qubit-scaling breakthrough. The Quantum Alliance is a standards body without Bitcoin Core representation. Coinbase's paper is a position document, not a protocol change.
Taken together, however, they represent a shift from theoretical discussion to operational preparation. The technical gap between current quantum hardware and the ECC-breaking threshold remains measured in orders of magnitude. But blockchain protocol upgrades operate on multi-year timescales, and the history of Bitcoin soft forks suggests that consensus formation — not code — is the binding constraint. The question is not whether post-quantum migration is needed, but whether decentralized governance can execute it before the window narrows.