Quantum Threat to Cryptocurrency: 2026 News & Developments
Last updated: August 23, 2026
The Quantum Threat: From Theory to Timeline
Quantum computers that can steal Bitcoin are no longer a theoretical future problem. They are an engineering problem on a measurable timeline - and no top-20 blockchain has post-quantum protection live on mainnet.
Error correction is proven - four independent teams on three continents have done it. Scaling is now engineering, not physics.
Google's 2026 whitepaper puts a Bitcoin attack at under 500,000 physical qubits, and Google has set its own Q-Day deadline of 2029. Microsoft's Majorana 2 puts its scalable-machine target in the same 2029 window.
A Caltech/Oratomic result shows a 10,000-26,000 qubit neutral-atom machine - a scale already built in the lab - could do it in days.
The attack itself keeps getting cheaper: the public ECDSA.fail leaderboard is now 60.9% leaner than Google's benchmark on the combined qubit-Toffoli metric (915,947 Toffolis x 1,278 logical qubits), it has overtaken the best privately held circuit, and its low-qubit record has fallen to 813 logical qubits (leaderboard snapshot, Aug 23, 2026; ECDSA.fail carries the live figures).
The timeline is hardening fast: the US Department of Energy is targeting a fault-tolerant machine by 2028, and Quantinuum, now public on Nasdaq after a $1.68 billion June IPO, a fully fault-tolerant system by 2030.
The deadlines are official: NIST deprecates today's encryption in 2030 and bans it by 2035; NIST, the NSA, and the Federal Reserve have all issued formal warnings.
The hardware is accelerating faster than expected, while the chains with the most at stake have barely started to migrate.
The Open Leaderboard Passes 60% Ahead of Google, and Overtakes the Best Private Circuit
The ECDSA.fail frontier reached 60.9% ahead of Google's benchmark circuit, with a best score of 1,170,580,266 (915,947 Toffoli gates on 1,278 logical qubits). A separate low-qubit record now stands at 813 logical qubits, below the 835 of the July academic design that held the previous width record. The board has drawn 493 promoted submissions from 125 solvers.
Two things are worth noting. The open, public frontier has now passed the best privately held result: doubleAI's WarpSpeed circuit scored 1.20 billion when published on August 15 with a zero-knowledge proof instead of open code, and the public board overtook it about a week later. And Eigen Labs has generalized the format into [Yukon](https://www.yukon.org/), a platform for running the same open "autoresearch" competitions on other technical problems. The algorithmic cost of Q-Day is being driven down in public, faster than any single lab has managed in private, while the coins the attack targets remain unmigrated.
The Record for the Cheapest Quantum Attack on Bitcoin's Curve Goes Private, Proved Without Showing the Circuit
doubleAI announced that WarpSpeed, its AI research system, designed a quantum circuit for breaking secp256k1 - the exact curve securing Bitcoin and Ethereum - using 993,181 Toffoli gates on 1,205 logical qubits, a combined spacetime score of 1.20 billion. That is roughly 2.5x more efficient than Google's published benchmark and about 19% ahead of the best entry on the public ECDSA.fail leaderboard, whose own frontier has meanwhile pushed past 50% ahead of Google at 1,154 logical qubits x 1.29 million Toffolis. Citing security concerns, doubleAI did not open-source the circuit: it published a zero-knowledge proof certifying that the design passes the challenge's full validation suite instead.
What was new here was not that software designed the circuit, which is true of the leaderboard entries as well, but that the result was sealed: for the first time the leading design was not public, only attested by cryptography. The algorithmic cost of Q-Day keeps falling on and off the leaderboard, while the coins the attack targets remain unmigrated.
Update, August 22, 2026: the open ECDSA.fail leaderboard overtook this circuit, retaking the frontier at a score of 1.17 billion.
The Qubit Floor for Breaking Bitcoin's Curve Drops to 835, a Third Lower in Three Months
A team spanning four Chinese research institutions posted a space-efficient quantum algorithm for elliptic-curve discrete logarithms that needs just 835 logical qubits for a 256-bit curve like secp256k1 - the lowest width yet reported, well under the previous floors of 1,098 (Chevignard et al.) and 1,175 (Google's low-qubit design). The same group's April preprint stood at 1,333; three months of optimization removed roughly a third of that. The design trades width for gates, spending far more Toffolis, so it does not lead the combined qubit-Toffoli metric - but it lowers the minimum machine size that could ever run the attack, and that floor is still falling. Fewer qubits needed means the hardware roadmaps have less distance to cover.
Reuters: The Industry Is Planning, Not Protected. No Top-20 Chain Has Shipped Post-Quantum Cryptography
A Reuters-sourced industry survey captured the state of play: crypto firms are drafting post-quantum plans, citing Google's 2029 estimate for encryption-breaking quantum machines, yet no top-20 blockchain has post-quantum algorithms live on mainnet. Ethereum's target remains 2029 for the base layer, and Algorand says post-quantum accounts arrive later this year. Roughly a year after Q-Day warnings went mainstream, the gap between roadmaps and shipped protection is the story.
Tron Puts NIST Post-Quantum Signatures on Its Nile Test Network, but the Hard Part Is Still Ahead
Tron deployed GreatVoyage-v4.8.2-PQ1-build1 on its Nile testnet, adding end-to-end support for two NIST-standardized signature schemes, FN-DSA-512 (Falcon) and ML-DSA-44 (Dilithium), across transactions, block production, P2P handshakes, and smart-contract verification via new TVM precompiles. It is the most complete post-quantum deployment yet by a major incumbent chain, and it delivers on the Q2 testnet pledge Justin Sun made in April.
But this is only the first of two steps, and it shows why upgrading a live chain is so hard. Step one is technical: get the new signatures working and switch them on for the real network. Even that is a heavy lift, because post-quantum signatures are far bigger than the ones used today, so wallets, exchanges, and every piece of infrastructure have to be reworked to handle them, and on Tron the block producers still have to vote the change onto the main network. Step two is the harder one, and no upgrade can do it for you: every existing holder has to move their coins from an old, exposed address to a new protected one, by hand. Anyone who does not move, including lost and dormant coins, stays exposed for good. So far Tron has done part of step one, on a test network only. A working test feature is not a protected network. QRL users have had this protection, across the whole system, since 2018.
StarkWare Publishes a Post-Quantum Roadmap for Starknet
StarkWare released a multi-phase plan to move Starknet's cryptography to post-quantum standards, leaning on the native quantum resistance of its STARK proof system. Phase 1 targets Falcon-512 signatures and BLAKE2 hashing for new on-chain activity by July 2026, and later phases cover migrating existing deployments and external dependencies, aligned with Ethereum's own timeline. Another major Layer-2 now treats the migration as a scheduled engineering program, and it is another reminder that L2 protection ultimately depends on the L1 underneath it migrating too.
QRL Marks Eight Years of Quantum-Safe Mainnet; QRL 2.0 Audits Reach the Halfway Mark
The QRL Foundation marked eight years of continuous post-quantum mainnet operation, with every transaction signed by hash-based XMSS since June 2018, and reported that the QRL 2.0 (Project Zond) audit program is now 50% fully complete and remediated, following the clean Halborn cryptography audit in April. Mainnet launch remains contingent on the successful completion of the full audit pipeline. While incumbents test their first post-quantum signatures, the chain that never needed a migration is finishing the reviews for its second post-quantum generation.
Quantinuum's $1.68 Billion Nasdaq IPO Prices Quantum's Timeline Into Public Markets
Quantinuum closed an upsized IPO at $60 per share, raising $1.68 billion in gross proceeds and listing on Nasdaq as QNT. Days earlier it demonstrated, with Microsoft, logical qubits performing roughly 800x better than the underlying physical error rates, and mid-June brought an HPC and AI integration deal with HPE. Public markets are now underwriting the fault-tolerance race at scale, and that kind of capital compresses timelines. Quantinuum's own roadmap targets a fully fault-tolerant system by 2030, squarely inside the window that matters for exposed crypto keys.
ECDSA.fail: A Public Leaderboard, With AI in the Race, Is Shrinking the Quantum Attack on Bitcoin's Curve
Eigen Labs launched ECDSA.fail, an open challenge asking one question: can you break ECDSA? Researchers, and increasingly AI research agents, compete to shrink the quantum circuit for attacking secp256k1, the exact curve securing Bitcoin and Ethereum, scored by the product of logical qubits and Toffoli gates against Google's benchmark circuit. Submissions are automatically verified, and the crowd pulled far ahead of Google's construction: by late June the leading circuit was down to roughly 1,152 logical qubits and about 1.32 million Toffoli gates, some 49% leaner than Google's benchmark on the combined qubit-Toffoli metric, with dozens of compounding micro-optimizations rolling in. Analysts tracking the challenge note the leading qubit constant has fallen from roughly 9n toward 4.355n.
This is a benchmark, not a live exploit: no hardware exists to run these circuits today. But it makes the trend measurable in public, in real time. The algorithmic cost of Q-Day is a falling number on a leaderboard, being pushed down by open competition and AI, while the hardware curve rises to meet it. Only the hardware side of the equation still protects unmigrated coins.
Microsoft Unveils Majorana 2 and Halves Its Timeline to a Scalable Quantum Computer by 2029
Microsoft unveiled Majorana 2, a topological qubit it says is roughly 1,000x more reliable than its predecessor, holding quantum information for about 20 seconds rather than microseconds. On that strength Microsoft now expects a scalable quantum computer by 2029, halving its previous timeline and putting another major lab's target in the same 2029-2030 window as Google.
New Paper Publishes Quantum Circuits for Attacking Bitcoin and Ethereum's Exact Curve
A new paper from Schrottenloher gives public quantum circuits for attacking secp256k1, the exact curve securing Bitcoin and Ethereum, matching recent work that cut the attack's qubit and gate cost by two to three times. The algorithmic cost of the attack keeps falling alongside the hardware progress.
U.S. Department of Energy Issues RFI for a 2028 Fault-Tolerant Quantum Computer
The DOE issued an RFI for a fault-tolerant system of 150-250 logical qubits by 2028. A national government is now treating an error-corrected machine as something to buy, not a distant research goal.
IonQ opened a 22,000-square-foot R&D lab in Boulder for semiconductor ion-trap chips, with its first system expected by late 2026. Its roadmap projects a cryptographically relevant quantum computer as early as 2028.
Q-CTRL and IBM Demonstrate a 3,000x Speedup on 120 Qubits
Q-CTRL and IBM reported a 3,000x speedup on a 120-qubit Fermi-Hubbard simulation using runtime error suppression. Today's pre-fault-tolerant hardware is already reaching beyond classical computers.
Bitcoin's BIP-361 Brings the "Freeze or Steal" Dilemma Into Focus
Bitcoin developers published BIP-361, "Post Quantum Migration and Legacy Signature Sunset," in the official repository on April 14, 2026. Its three phases would stop payments to vulnerable addresses (~3 years after activation), invalidate legacy ECDSA/Schnorr signatures (~5 years), and, in a still-research phase, let owners reclaim frozen coins with a zero-knowledge proof of their seed phrase.
It exists because BIP-360 protects only new coins, leaving ~34% of all BTC (6.5 to 6.9 million, including ~1.7 million Satoshi-era coins) permanently exposed. That is the freeze-or-steal dilemma: freezing lost coins offends Bitcoin's core promise, but leaving them makes them quantum bounties. And BIP-361 is still a draft with no activation timeline; a co-author estimates full migration at about seven years once consensus forms, which it has not.
Tron Pledges a Post-Quantum Mainnet as the Incumbent Race Accelerates
Justin Sun said Tron will put NIST post-quantum signatures on mainnet, targeting a Q2 2026 testnet and Q3 2026 mainnet, and billed it as the "first major public blockchain" to do so. As of mid-April it was only an announcement, with no formal on-chain proposal or technical spec, and the "world's first" claim overlooks QRL, post-quantum since 2018. Others are moving too: Solana has PQ signatures on testnet, and Coinbase formed a quantum advisory board in January. The race shows both the urgency and the difficulty of retrofitting a live chain with millions of legacy addresses. (Update: the testnet pledge was delivered on June 30; see above.)
Independent Audit Finds No Vulnerabilities in QRL's Post-Quantum Cryptography
An independent Halborn audit of QRL's two NIST post-quantum signature libraries found no cryptographic vulnerabilities; all 13 findings were Informational and have been resolved. It followed the March 31 QRL 2.0 Testnet V2 launch (Hyperion plus the QRVM). Google's March 30 whitepaper had already named QRL as presently post-quantum-secure.
"A fix exists" is not the same as "safe." A chain is safe only when its whole stack, the base protocol, every account, and the contracts, bridges, and value on top, is migrated before Q-Day. Here is what today's fixes actually cover:
Fix
Protects
Does not protect
Bitcoin BIP-360 (P2MR)
new addresses, coins at rest
coins on spend (the key still appears in the mempool when you move them); any existing coin
Bitcoin BIP-361
proposes freezing or migrating legacy coins
draft only, no activation date; freezing lost coins is contested
Ethereum by 2029
the base protocol (validator signatures, KZG, ZK proofs)
accounts, smart contracts, bridges, Layer-2s
Tron testnet (June 2026)
new PQ signature types, on testnet only
switching it on for the real network (still needs a network vote); every holder moving their own coins; wallet and exchange support
QRL since 2018
the entire stack, from genesis
nothing left to migrate
Bitcoin: the migration dwarfs the fix. BIP-360 covers only new addresses, and only at rest; the instant you spend, the public key is exposed in the mempool. Existing coins are worse off: about 34% of all BTC (6.5 to 6.9 million, including ~1.7 million Satoshi-era coins) already have exposed keys that no upgrade can hide. And the scale is brutal: moving Bitcoin's ~190 million UTXOs at the network's ceiling of ~7 transactions per second would take roughly a year of blocks doing nothing but migration, and multi-year in practice. Every migration transaction briefly exposes its own key while it waits to confirm.
Ethereum: the base layer is the easy part. The 2029 target covers the protocol only. The value sits above it: hundreds of millions of ECDSA accounts, the whole smart-contract and DeFi stack, bridges, and Layer-2s, each with its own cryptography and its own upgrade path. Many contracts are immutable and cannot be patched in place; they must be redeployed and their liquidity moved. Because DeFi is composable, one protocol depends on tokens, oracles, bridges, and an L2 that must all migrate together. No one can mandate it: it is voluntary coordination across hundreds of millions of accounts and thousands of independent teams (per-account wallet agility, via EIP-8141, is still only proposed for late 2026). A 2029 base layer is a milestone, not safety.
QRL was post-quantum from its 2018 genesis (XMSS) and carries that into EVM smart contracts with ML-DSA-87, now on an independently audited public testnet. There is nothing to migrate before Q-Day.
The throughline of 2026: the chains with the most at stake face the hardest migrations, while the protection they are racing toward has been live on QRL for years.
Public qubit-Toffoli benchmark for breaking secp256k1; solvers 60.9% ahead of Google's circuit at 915,947 Toffolis x 1,278 logical qubits, with a low-qubit record of 813. Figures quoted here are a snapshot from Aug 23, 2026: the live board is the source of truth