Three research papers published between May 2025 and March 2026 compressed the estimated timeline for a cryptographically relevant quantum computer by an order of magnitude. Google Quantum AI's March 31 paper — co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographe...
"The network has already validated over 100 million transactions using post-quantum cryptography. That is not a roadmap promise; it is measured, operational capacity." — Nathaniel Szerezla, Chief Growth Officer, Naoris Protocol
Three research papers published between May 2025 and March 2026 compressed the estimated timeline for a cryptographically relevant quantum computer by an order of magnitude. Google Quantum AI's March 31 paper — co-authored with Ethereum Foundation researcher Justin Drake and Stanford cryptographer Dan Boneh — concluded that breaking the 256-bit elliptic curve cryptography protecting Bitcoin and Ethereum requires fewer than 500,000 physical qubits, a 20-fold reduction from the 9–10 million qubit estimates that prevailed as recently as 2024. The paper modeled a scenario in which a sufficiently powerful quantum machine derives a private key from an exposed public key in approximately nine minutes — within Bitcoin's 10-minute block confirmation window.
The combined value at risk is substantial. According to CoinDesk reporting on the Google paper, approximately 6.9 million BTC (roughly $460 billion at current prices) sit in wallets with exposed public keys. On Ethereum, the paper flags $100 billion in directly vulnerable assets across exposed wallets, staked ETH, and rollup bridges, plus an additional $200 billion in stablecoins and tokenized assets governed by quantum-vulnerable admin keys. Bitcoin traded at approximately $66,834 and Ethereum at $2,054 as of April 3.
The response from major networks is divergent in speed and approach. Naoris Protocol launched a post-quantum Layer 1 mainnet on April 1. Bitcoin developers merged BIP 360 into the official repository on February 11 but face a projected seven-year migration timeline. Ethereum's Vitalik Buterin published a four-year quantum resistance roadmap in February. Solana introduced an experimental Winternitz Vault in December 2025. The gap between threat acceleration and protocol migration timelines is the central risk factor for the $2.3 trillion crypto market.
Three papers published in rapid succession rewrote the qubit requirements for breaking public-key cryptography.
Paper 1 — Gidney (May 2025): Google Quantum AI researcher Craig Gidney demonstrated that RSA-2048 encryption could be broken with fewer than one million noisy physical qubits in under a week. His 2019 estimate had been 20 million qubits. The reduction stemmed from innovations in approximate residue arithmetic, yoked surface codes for higher-density qubit storage, and magic state cultivation for fault-tolerant gates. The analysis assumed conservative hardware parameters: square qubit grids, 0.1% gate error rates, and one-microsecond surface code cycles.
Paper 2 — Iceberg Quantum (February 2026): This Sydney-based startup introduced the Pinnacle architecture using quantum low-density parity-check (QLDPC) codes instead of surface codes, projecting that RSA-2048 could fall with fewer than 100,000 physical qubits. The Quantum Insider reported this represents roughly a 10x reduction from Gidney's already-reduced estimate. The work remains simulation-validated rather than hardware-proven and requires qubit connectivity beyond nearest-neighbor grids.
Paper 3 — Google Quantum AI (March 2026): The most consequential paper for crypto markets. Google researchers, working alongside Ethereum Foundation's Justin Drake and Stanford's Dan Boneh, showed that breaking the ECDLP-256 curve protecting Bitcoin (secp256k1) and Ethereum requires fewer than 500,000 physical qubits with a runtime measured in minutes, not days. ECC requires approximately 100 times fewer Toffoli gates than RSA-2048 (70–90 million versus 6.5 billion), explaining the dramatic runtime collapse once precomputation of fixed curve parameters is complete.
Google's current most advanced quantum processor, Willow, contains 105 qubits. The gap between 105 and 500,000 remains vast, and no researcher has claimed such a machine exists or is imminent. Google itself has set a 2029 internal migration deadline for post-quantum cryptography.
The trajectory of qubit requirements for RSA-2048, according to The Quantum Insider, has followed a consistent downward curve: hundreds of millions to ~1 billion (2012), ~20 million (2019), fewer than 1 million (2025), fewer than 100,000 (2026). Each revision has come faster than the last.
Bitcoin: Approximately 6.9 million BTC — roughly one-third of total supply — reside in wallets where the public key has been exposed on-chain, according to CoinDesk analysis of the Google paper. This exposure occurs when users reuse addresses, custodians employ operational shortcuts, or coins sit in older address formats (P2PK). The amount includes an estimated 1 million BTC attributed to Satoshi Nakamoto, valued at approximately $67.6 billion.
Google's paper estimated that a quantum attacker could derive a private key from an exposed public key and redirect a Bitcoin transaction with roughly 41% probability before block confirmation under idealized conditions.
Ethereum: Google's analysis identified five distinct attack vectors on Ethereum. According to CoinDesk, approximately 20.5 million ETH is held in accounts with exposed public keys. An additional 37 million staked ETH is authenticated via digital signatures the paper considers quantum-vulnerable. At least 15 million ETH across major rollups and cross-chain bridges is exposed. The top 1,000 wallets and at least 70 major admin-controlled smart contracts — including those backing key stablecoins — hold approximately 2.5 million ETH in quantum-vulnerable configurations. Total stablecoin and tokenized asset exposure governed by vulnerable admin keys: approximately $200 billion.
Combined estimate: The Google paper and associated CoinDesk reporting place over $760 billion in crypto assets in some category of quantum vulnerability. This figure does not include assets on Solana, Avalanche, or other ECC-dependent chains.
The four largest smart contract ecosystems are moving at markedly different speeds.
Bitcoin — Deliberate and Contested: BIP 360, authored by Hunter Beast and Ethan Heilman, was merged into Bitcoin's official BIP repository on February 11, 2026. The proposal introduces Pay-to-Merkle-Root (P2MR), a new output type that removes Taproot's quantum-vulnerable key path spend, committing solely to the Merkle root of a script tree. BTQ Technologies deployed BIP 360 with Dilithium post-quantum signature opcodes on a testnet in March 2026, according to a Nasdaq press release.
BIP 360 addresses long-range attacks (where an attacker has extended time to crack a key) but does not protect against short-range attacks during transaction broadcast. Co-author Heilman estimated that a full migration to quantum resistance would take seven years from initiation, a timeline he characterized as optimistic. A separate "Hourglass" proposal would gradually restrict usage of vulnerable coin types, giving holders time to migrate. Community consensus on either approach remains incomplete.
Ethereum — Structured but Multi-Year: Buterin published a quantum-resistance roadmap in February 2026, identifying four vulnerability domains: validator signatures, KZG commitments in data availability, user wallet signatures, and certain zero-knowledge proofs. The proposed fix for validator signatures involves switching to hash-based signatures. User wallets would be addressed through EIP-8141, which introduces more flexible wallet architecture. The timeline falls under the Strawmap, a four-year Layer 1 upgrade plan published at strawmap.org following an Ethereum Foundation workshop in January 2026. The Ethereum Foundation established a dedicated post-quantum research team in 2025. Coinbase formed an independent advisory board of cryptographers and quantum experts to assess risks.
Solana — Experimental: Solana introduced the Winternitz Vault in December 2025, offering optional storage in smart contract-based vaults secured by hash-based, one-time signatures. The approach is opt-in rather than protocol-mandated. Project Eleven leads post-quantum security research for Solana. Quantum computing has not become a sustained focal point in Solana's ecosystem discourse, according to CoinDesk.
Naoris Protocol — Production-Ready (New Entrant): Naoris launched its mainnet on April 1, 2026, as the first blockchain built from inception with NIST-approved post-quantum cryptography (ML-DSA, the standardized version of CRYSTALS-Dilithium, published as FIPS 204 in August 2024). The network operates on a dPoSec (Decentralized Proof of Security) consensus model. Its testnet processed 106 million post-quantum transactions and blocked 603 million security threats, according to the company; these figures remain independently unverified per Decrypt. The protocol's PQC-binding system enforces irreversible transitions: once an account adopts quantum-resistant keys, ECDSA-only transactions are permanently rejected. The NAORIS token had a market capitalization of $36 million at launch, per CoinDesk.
Government mandates are compressing timelines independent of market dynamics.
NIST finalized three post-quantum cryptography standards in August 2024: ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), ML-DSA (Module-Lattice-Based Digital Signature), and SLH-DSA (Stateless Hash-Based Digital Signature). NIST has set a migration deadline of 2029 and will deprecate quantum-vulnerable schemes after 2030 and disallow them after 2035.
The NSA's CNSA 2.0 directive mandates quantum-safe systems across all National Security Systems by January 2027. The White House released an updated National Cybersecurity Strategy in March 2026 accelerating PQC adoption across federal systems. The EU has mandated national PQC strategies by 2026, quantum-resistant encryption for critical infrastructure by 2030, and full transition by 2035.
2026 has been designated the "Year of Quantum Security," a joint initiative of the FBI, NIST, and CISA. The SEC cited post-quantum infrastructure frameworks as early as September 2025.
These regulatory timelines do not directly govern decentralized protocols, but they set benchmarks that institutional participants — custodians, exchanges, regulated stablecoin issuers — must meet. Any institution holding crypto assets in quantum-vulnerable configurations after 2030 faces compliance risk under these frameworks.
The quantum threat to cryptocurrency has shifted from theoretical to quantified. Google's research, published with co-authors from the Ethereum Foundation and Stanford, establishes concrete qubit thresholds and attack runtimes that the industry must now plan against. The data does not indicate an imminent attack — 105 qubits versus 500,000 is a wide gap — but the consistent downward trajectory of qubit requirements, combined with the multi-year timelines required for protocol migration, creates a closing window.
The economic value at stake is measurable: hundreds of billions in assets secured by cryptographic primitives that have a defined expiration date. Protocols that cannot demonstrate credible migration plans face both technical risk and regulatory non-compliance risk as NIST, NSA, and EU deadlines approach. The market has not yet priced this migration cost. The "harvest now, decrypt later" threat means the clock started before the quantum computer arrived.