Dr. Antoun ToubiaFor years the comfortable answer was that quantum computers would not threaten cryptography before 2040. The research and the hardware no longer support that comfort. This is what changed, what the three most watched networks actually have, and what their upgrades still do not cover.
19 October 2026 · Dr. Antoun Toubia
The date that moved
The old 2040 answer rested on a simple assumption: a useful quantum computer would need millions of physical qubits, and the engineering would take decades. That assumption is now out of date.
The number that matters is not the physical qubit count. It is the logical qubit count, the number of error corrected qubits a machine can use for a real calculation. In 2024, Google Willow demonstrated 1 logical qubit. In 2025, Quantinuum Helios reached 48 logical qubits from 98 ions. In January 2026, QuEra reached 96 logical qubits from 448 atoms. Quantinuum and Pasqal target 100 or more in 2027. Industry forecasts now point to 1,000 or more verified logical qubits around 2029.
Google’s March 2026 paper estimates that breaking 256 bit elliptic curve cryptography needs about 1,200 to 1,450 logical qubits and fewer than 500,000 physical superconducting qubits. The gap between 96 and 1,200 is still large. It is also much smaller than the gap the 2040 story assumed.
My judgement is that 2029 and 2030 are possible, the central window is 2030 to 2033, and 2040 is the late tail, not the base case. I would put a practical ECC 256 key recovery by 2030 at roughly 20 to 30 percent, by 2033 at roughly 40 to 50 percent, and by 2040 at roughly 70 to 80 percent. A broad break of Bitcoin and the banking system is lower, and RSA 2048 is later. These are judgements, not measured probabilities.
What a quantum computer actually breaks
Shor’s algorithm breaks the public key cryptography that proves ownership and protects key exchange. That includes ECDSA, EdDSA, RSA and Diffie Hellman. Bitcoin uses ECDSA over secp256k1. Ethereum uses ECDSA over secp256k1 for accounts and BLS signatures for validators. Banks use RSA and elliptic curve certificates, TLS key exchange, hardware security modules and code signing. Stablecoins, exchanges, bridges and custodians sit on the same foundations.
Grover’s algorithm is a different problem. It can search faster, but it does not break symmetric cryptography in the same way. It roughly halves the effective security level, so AES 256 still has a large margin. Hashing is also not broken in the same way. The acute risk is to signatures and public keys, not to every cryptographic primitive at once.
This distinction matters because it changes the response. A bank does not need to replace every hash function. It needs to replace the keys and signatures that authenticate value, and it needs to do so before the public keys are exposed.
Why 2029 and 2030 are possible now
The old estimates were built on the surface code, which needs a very large number of physical qubits for each logical qubit. New codes change the arithmetic. IBM has demonstrated a quantum low density parity check code that encodes 12 logical qubits in 288 physical qubits, about 24 to 1. Quantinuum has shown a ratio near 2 to 1. QuEra has shown about 4.7 to 1. At those ratios, 1,000 logical qubits need only a few thousand physical qubits, not millions.
That is why the hardware ceiling is no longer the whole story. Caltech has already trapped about 6,100 atoms. IBM’s Starling machine targets 200 logical qubits in 2029. DARPA’s Quantum Benchmarking Initiative targets an industrially useful fault tolerant machine by 2033. In September 2026, European financial supervisors warned that the blockchain threat is imminent and cited about 6.9 million BTC in exposed addresses, worth about 586 billion dollars.
The remaining bottleneck is the hard part. A logical qubit count is not the same as a working algorithm. The machine needs sustained logical gates, magic state preparation, real time decoding, enough runtime, and software that can compile a full attack. Most current records are memory or small operations. That is why 2029 is possible but not certain, and why 2030 to 2033 is the more honest centre.
The 500,000 qubit headline, read correctly
The headline says 500,000 qubits. It means 500,000 physical qubits, not 500. The same paper estimates 1,200 to 1,450 logical qubits, fewer than 500,000 physical qubits, and about 90 million Toffoli gates. It describes an attack on a transaction while it waits in the mempool, about nine minutes of computation with a 41 percent chance of beating confirmation.
The second paper is even more aggressive in one direction. Oratomic and Caltech estimate that Shor is possible with as few as 10,000 reconfigurable atomic qubits, and that 26,000 physical qubits could solve the discrete log on P 256 in days. That design has a slower clock. The Google design has a faster clock and a larger physical count. Both are estimates. Neither is a machine, and neither is a successful Bitcoin break.
The useful conclusion is not that Bitcoin is already broken. It is that the planning number has fallen far enough to make a 2030 to 2033 window credible. A ten year procurement cycle now overlaps the risk window.
The exposure is already onchain
A quantum attacker does not need to break every wallet at once. The easiest targets are the ones whose public keys are already visible. Early Bitcoin pay to public key outputs exposed the key directly. Address reuse exposes it again. Taproot outputs expose the key when they are spent, or when the script path is used. More than a third of circulating Bitcoin supply is estimated to sit in addresses with exposed public keys.
Some of that supply can move. Some cannot. Lost keys, abandoned wallets and the earliest coins have no owner who can rotate a key or move the balance. That is why the exposure is not only a technical problem. It is a governance problem, and it is already on the ledger.
Banks have a different version of the same problem. Their keys sit in hardware modules, certificate authorities and vendor systems. A bank can replace a key centrally, but it cannot replace every customer device, every partner connection and every legacy application on the same day. Stablecoins and bridges add another layer: a bridge may be quantum resistant on one chain and classical on the other.
Ethereum: account abstraction is not a shield
Ethereum’s account model uses ECDSA over secp256k1. Validators use BLS signatures. Data availability uses KZG commitments. The roadmap is moving toward account abstraction through Lean Ethereum and EIP 8141, and smart contract wallets can already verify new signature schemes. STARKs, which are hash based, give Ethereum a quantum resistant tool for proofs.
But a tool is not a migration. EOAs are still ECDSA. Validators are still BLS. KZG is still built on an elliptic curve. Bridges and layer two networks run their own code, often with their own keys. The Ethereum Foundation has a 2029 target for quantum resistant protection through planned hard forks, but there is no protocol level PQC signing on mainnet today.
Account abstraction changes who can authorise a transaction. It does not change what the base layer verifies. A new smart wallet can adopt PQC. An old EOA cannot. A validator set cannot switch its consensus signatures without a coordinated upgrade. That is the difference between a path and a completed migration.
NEAR: the furthest ahead, still not finished
NEAR deserves credit for shipping something real. Nearcore 2.13 activated ML DSA 65 account keys on mainnet in 2026. A user can rotate to a quantum resistant key in one transaction, with no asset migration and no new address. The account model separates identity from access keys, which makes that rotation possible.
It is still not a complete shield. Ed25519 and secp256k1 remain supported. Validators still use classical signatures, and the target for post quantum consensus is the end of 2027. Chain Signatures and NEAR Intents carry PQC on the NEAR side, not on the destination chain. Most wallets and current hardware wallets do not support ML DSA yet. The signature is about 3,309 bytes against 64 bytes for Ed25519, roughly 50 times larger. Tests on permissioned networks have shown throughput falls by 52 to 57 percent.
So NEAR is ahead of the other two networks on account level signing, and it is honest about the rest. It has not finished the job, and no user should assume that holding NEAR is automatically quantum safe. The user has to rotate the key. The wallet has to support it. The validator set has to migrate.
Sui: agility is a plan, not proof
Sui supports Ed25519 and ECDSA for user accounts, BLS for validator operations, and Groth16 over BN254 and BLS curves for zero knowledge proofs. zkLogin uses Groth16. The design is deliberately flexible: multiple signature schemes can coexist, and smart contracts can verify new schemes without a protocol change.
That flexibility is a real advantage. It is also not the same as being quantum proof. Sui is preparing quantum resistant account schemes, but PQC is not live on mainnet for all accounts. Validators still use BLS. zkLogin still depends on Groth16 and BN254. Bridges and applications can choose their own cryptography, which means the network cannot promise that every asset or every path is protected.
The phrase to watch is cryptographic agility. It means a path exists. It does not mean the migration has happened, and it does not mean the old keys disappear.
What every upgrade leaves out
Every one of these networks can add a new signature scheme. None of them can make the old keys vanish. The old EOA, the old Ed25519 key, the old validator key and the old bridge key remain valid until someone removes them. An attacker with a quantum computer will choose the weakest key that still controls value.
The second gap is collective. A chain can upgrade its account format, but it cannot force every wallet, custodian, exchange and hardware device to support the new format on day one. The third gap is size. PQC signatures are 10 to 100 times larger than the signatures in use today. That affects block space, fees and throughput. The fourth gap is governance. A decentralised network needs rough consensus, and consensus takes time.
This is why the claim that a chain will be quantum proof after a future upgrade is incomplete. It may be quantum resistant for new accounts, on one layer, with new wallets, after a coordinated migration. That is progress. It is not a guarantee for the whole system, and it is not 100 percent.
The 2030 to 2033 window
The signals to watch are specific. A machine with 100 or more logical qubits running sustained gates in 2027. Five hundred or more in 2028. One thousand or more verified logical qubits in 2029. A demonstrated 256 bit elliptic curve key recovery, even on a test network. A working qLDPC code at full algorithm scale. A real time decoder and a magic state factory that can run for days, not minutes.
For an institution, the work starts before those signals arrive. Inventory every key, every certificate, every signing service and every vendor. Find the keys whose public halves are already exposed. Stop address reuse. Move to quantum resistant wallets where they exist. Plan a hybrid period, with classical and PQC signatures side by side. Treat BIP 360 as a way to reduce long term exposure, not as a complete answer.
For an individual, the first steps are simpler. Do not reuse addresses. Keep software current. Use a wallet that is actively working on PQC support. Understand that a hardware wallet is not automatically quantum safe. And do not panic: no machine can break Bitcoin today.
In closing
The comfortable date was 2040. The evidence now points to a migration race in the 2030 to 2033 window, with 2029 and 2030 as real possibilities. That does not mean a quantum computer is sitting in a vault today. It means the time between the research and the risk is shorter than the time most institutions need to replace their keys.
Ethereum, NEAR and Sui are all moving. NEAR has the strongest live account level step. Ethereum has the deepest smart contract and proof ecosystem, and a 2029 roadmap. Sui has the most flexible cryptography. None of them is fully quantum proof, and none of them will be after a single upgrade. The honest position is that this is a patchwork, not a shield.
The correct response is not panic. It is inventory, migration and patience with the engineering. The wrong response is to wait for 2040.
Sources
- Google Quantum AI, ECC resource estimates, 2026
- Oratomic and Caltech, atomic qubit estimates, 2026
- NEAR post quantum account keys, Crypto Briefing, August 2026
- NEAR live quantum safe account signing, TechTimes, July 2026
- Sui cryptography documentation
- Ethereum accounts documentation
- Bitcoin BIP 360, P2MR
- Ethereum quantum resistance target, FinanceFeeds, August 2026
Dr. Antoun Toubia has 17 years of experience in the crypto space, 25 years in financial markets, and a PhD in Business Administration and Financial Management.