The Quantum Gap Is Closing. Bitcoin's Real Clock Is Its Governance.

Two research papers landed on the same day in late March, and together they rewrote the arithmetic of how big a quantum computer has to be to crack Bitcoin. Google and NYU researchers published circuits that could break the secp256k1 key behind Bitcoin in minutes using fewer than 500,000 physical qubits — against a widely repeated early-2020s estimate that pegged a one-hour break at roughly 317 million physical qubits. A second, unpeer-reviewed paper from a neutral-atom hardware team claimed as few as 10,000 reconfigurable qubits could do the job, citing a roughly 100-fold cut in the error-correction overhead that dominated older estimates. Google called its own improvement about a 20-fold reduction.

None of this is a machine yet, and nobody close to the field pretends otherwise. IBM's marquee system this year, Kookaburra, is built around a chip of about 4,158 physical qubits; Microsoft and Quantinuum demonstrated 12 logical qubits in March. Johns Hopkins cryptographer Matt Green has described the framing as alarmist, even a PR trick, precisely because the hardware does not exist. That skepticism is the correct baseline — the real bottleneck everyone, optimist and skeptic alike, names is fault tolerance: building error-corrected logical qubits at scale, which no architecture has yet demonstrated. Here's the catch that steady state conceals: none of it changes the math on what's already public, because nobody stealing your Bitcoin needs to outrun a stopwatch.

The "minutes versus hours" performance talk only matters for an attack that has to race a transaction as it's broadcast. For the threat that actually matters, a year of computation is plenty. It's called harvest-now-decrypt-later, security teams already treat it as active, and the data to harvest was published voluntarily: the full public keys of every Bitcoin address that has ever been spent from, stored on the blockchain forever.

This is where Bitcoin's mechanics bite. A modern address doesn't hold your public key; it holds a scrambled hash of it, and until you reveal the key, that hash gives a quantum computer nothing to work with. The moment you spend from an address, the full key goes on-chain to verify the transaction — permanently, and for every coin still sitting at that address. Spend from an address once and whatever remains there joins a standing pool of exposed value. That's key reuse.

The size of that pool is the most underrated number in this story. BIP-361, the Bitcoin proposal that lays out the migration, counts more than 34% of all bitcoin as having revealed its public key on-chain as of March 1, 2026 — about 6.8 million coins, on the order of $500 billion at today's ~$78,000 price. Other counts cluster lower, between roughly 4.5 and 6.9 million bitcoin, so the estimates disagree on the decimal place but every serious one lands in "a quarter to a third of the supply." Coin Metrics attributes about 1.7 million bitcoin to early P2PK outputs — including much of Satoshi's coinbase — and says most of the rest comes from key reuse after 2017.

Nothing in that pool is spendable today, and it may stay locked for a long time. But the paper arithmetic kept moving in one direction through 2026: the Global Risk Institute put the chance of a machine that breaks RSA-2048 within ten years at 17–22%, and elliptic-curve keys of the kind Bitcoin uses are generally considered the easier target, not the harder one.

Which is why the interesting race is not hardware against time. It's Bitcoin's governance against the clock. Bitcoin doesn't upgrade by decision; it upgrades by consensus — nodes, miners, exchanges, custodians, and wallet vendors converging on a change with something close to unanimity. That coordination is historically measured in years, and it's the thing every serious threat assessment names, not the physics. BIP-361, a draft by Jameson Lopp and five co-authors, tries to impose a schedule anyway: a first phase about 160,000 blocks after activation (roughly three years) would stop funds from being sent to quantum-vulnerable address types; a second phase, a "flag day" about five years out, would encumber legacy ECDSA and Schnorr spends with a rescue protocol that leans on what a legitimate holder knows and an attacker cannot compute. As of mid-2026 it is a draft with no activation timeline, and a parallel draft, BIP-360, would add output types that keep keys off the chain altogether.

Institutions are now setting the deadline the network hasn't agreed on. Google, which said in March it would bring its own systems to post-quantum cryptography by 2029, has since published crypto-specific guidance — move blockchains to post-quantum signatures, stop reusing or exposing wallets, settle a policy for abandoned coins — and says it's coordinating with Coinbase, Stanford's blockchain research group, and the Ethereum Foundation. Washington accelerated its own post-quantum deadline from 2035 to 2030–31 in a pair of June executive orders. Within days Moody's put a 2030 target on decentralized networks achieving quantum resistance and called ecosystem-wide coordination the "harder problem" — which, from a credit-rating agency, is a way of saying it is already figuring out who absorbs the loss.

That distribution is the real story, and it's not the doomsday version. The network won't die one night; it will migrate, and the survivors will be the ones that migrated. The deterministic losers are the coins that can't or won't. Roughly 1.7 million bitcoin in old P2PK outputs, including most of Satoshi's stash, can't volunteer for any migration — BIP-361's own analysis notes no known rescue protocol exists for them, and if the hardware arrives they are effectively frozen or confiscated, a supply cut no committee voted on. After them come the dormant cold wallets, the lost passwords, the exchange deposit addresses reused for years, and every retail holder who reused an address because an old wallet or an exchange taught them to. Small and uncoordinated holders are last in line, not because anyone is hostile but because the consensus mechanism that makes Bitcoin hard to change is the same mechanism that caps how fast it can move.

Read as an investment fact, that changes what there is to watch and do. This is not a trade you can time from a chart: bitcoin trades near $78,000, roughly 38% below its 52-week high, with the crypto fear/greed index in greed — the tape is being driven by macro, and there's no visible quantum discount anywhere in it. Verdict: the risk is real, but it's a governance-migration risk with a multi-year horizon that falls unevenly on uncoordinated holders, not a price event you can spot on a screen. The part that is free and immediate is wallet hygiene. Modern wallets derive a fresh address per payment; the exposure trap is reused addresses — old single-address wallets and exchange deposit addresses that collect many deposits. Coins sitting at a reused address can be moved to a fresh one, which buys hash-delay protection until post-quantum output types exist; moving has fees and tax consequences, so the honest framing is that you're repositioning your exposure, not fixing the system. And the indicator that actually matters is not qubit headlines. It's governance: whether BIP-361 or something like it activates and starts its three-to-five-year clock, whether mainstream exchanges and wallets ship post-quantum outputs, and how far logical-qubit counts have climbed from a dozen. Activation is the moment the deadline gets real — once the migration schedule exists, the schedule, not the hardware, becomes the binding constraint.

The gap in the title is closing on both sides at once: on what a crack was believed to require, which fell by a factor of 20 to 100 in a single year of paper estimates — and on the institutional clocks, which keep getting pulled earlier, 2035 to 2030–31, Google's 2029, Moody's 2030. What hasn't closed is Bitcoin's own clock, because that one doesn't run on physics. It runs on the thousands of wallets, exchanges, miners, and node operators who have to agree before the network can move. In a quantum event, the people who lose won't lose because they misjudged the hardware. They'll lose because the exposed inventory was fixed years ago, and a migration, whenever it triggers, is a schedule — and every schedule has stragglers.