We asked our newsletter readers whether quantum computing could break Bitcoin by 2035. Last week, on July 28, an AI model, not yet publicly released, discovered a vulnerability in a post-quantum signature scheme that two years of manual review had not uncovered. No quantum computer was used here. This report examines what Bitcoin is, the real threat to $BTC, and why last week's events add a whole new dimension to the quantum computing timeline.
Where Our Readers Stand
If we add those who answered 'yes, it will probably happen' to the 'by 2030' group, it turns out that 47% of readers see the potential for a quantum breach of Bitcoin within the next nine years. To date, the largest elliptic curve key cracked on actual quantum hardware is 15 bits, which happened this past April thanks to a researcher vying for the Q-Day prize as part of Project Eleven. For comparison, Bitcoin keys are 256 bits, and progressing bit by bit over nine years would require incredible engineering innovation. About one-third of this audience currently sees this as a real possibility.
What Is Actually at Risk for $BTC?
Before we delve into the survey results in detail, it's important to clarify that Bitcoin does not encrypt anything. No secret message is encrypted, and every transaction on the network has always been public since its inception. Bitcoin only performs signing and hashing. Two different tasks, two different mathematical operations, two completely different quantum timelines.
The part responsible for signing is vulnerable. When you spend Bitcoin, your wallet generates a signature confirming your ownership of the coins, and this is done using elliptic curve cryptography called secp256k1. Over the years, Bitcoin has used two signing methods: ECDSA from the start and Schnorr since 2021. The security of both is based on one assumption: it is impossible to derive the private key from the public key.
This is where Shor's algorithm comes into play, targeting this assumption. Given a sufficiently large quantum computer, it could work backwards from a public key to the private key that generated it. In March of this year, Google researchers published estimates that this requires less than 1,200 logical qubits and less than 500,000 physical qubits. A later paper from Caltech and Oratomic reduced this number to 10,000 qubits using a neutral-atom-based architecture. No one has built anything like this yet. But these figures were previously in the millions, and it is the direction of travel that is the reason Bitcoin has stopped viewing this as a 2040s problem.
Hashing is in much better shape. Bitcoin uses SHA-256 for mining, address generation, and linking blocks. The best quantum attack against it is Grover's algorithm, which only provides a quadratic speedup. In practice, this reduces the security of a 256-bit code to something like 128-bit, which remains out of reach for any machine anyone has ever designed on paper. Mining is not the weak link here, nor is the blockchain structure.
Therefore, the precise wording of the question is narrower than 'quantum technology breaks Bitcoin.' At risk are coins whose public keys are already publicly available on the blockchain. This happens when funds at an address have been spent before, or when funds are stored in older address formats that reveal the key by default. The current estimate is between 6.5 and 6.9 million $BTC, which is roughly a quarter to a third of the total supply, and this figure includes about 1.7 million coins on early addresses widely believed to have belonged to Satoshi.
Coins stored on modern addresses and never used for a transaction do not reveal their public key at all. In the case of such coins, a quantum attacker would only have the window of a few minutes while a transaction is in the mempool awaiting confirmation to gain access to the key. Nevertheless, this is a problem worth solving. And it is much smaller than the stated figure suggests.
Bitcoin's Response to the Quantum Problem
On February 11, 2026, BIP-360 was included in the official Bitcoin BIPs, becoming the network's first formal quantum resistance proposal to reach that level. It introduces a new output type called Pay-to-Merkle-Root, or P2MR, authored by Hunter Biest, Ethan Heilman, and Isabelle Foksen Duke.
P2MR is essentially Taproot, but without spending via the key path. Taproot commits transactions to both an internal public key and a Merkle root of scripts, meaning the key can always be derived from what is on the blockchain. P2MR commits transactions only to the Merkle root. The public key is not revealed until you actually spend the funds, and even then, only the specific leaf key you used is revealed. This closes the long-term exposure vulnerability.
A companion proposal, BIP-361, was submitted on April 14, outlining a three-phase plan to completely deprecate ECDSA and spend via Schnorr. It is this one that is controversial, as the third phase effectively freezes coins that will never be migrated.
Here is what to watch. By Heilman's own estimate, it will take seven years from consensus formation to full quantum resistance, and he calls this an optimistic forecast. Two and a half years for review and testing. Six months for activation. Then another five years before roughly 90% of wallets, custodians, Lightning nodes, and treasury software are actually updated. Notably, BIP-360 does not include post-quantum signatures at all. They were removed in July 2025 and deferred to a future proposal. The scheme Bitcoin will likely eventually adopt is ML-DSA or SLH-DSA—algorithms NIST has already finalized.
And this brings us to last week's events.
A Post-Quantum Scheme Failed, and No Quantum Computer Was Involved
On July 28, Anthropic's Frontier Red Team published the results of research using their Claude Mythos Preview model, which is not publicly available. Operating in a semi-autonomous agentic environment, it discovered a previously unknown attack on HAWK, one of the nine finalists in NIST's additional post-quantum signature competition and the only lattice-based scheme that advanced to the third round in May.
The attack exploited a symmetry in HAWK's lattice structure that had not been applied before. For the HAWK-256 parameter set, the estimated number of operations to recover a key was reduced from about 2^64 to about 2^38. Simply put, that's the difference between statements like 'no adversary in the world will do this' and 'a well-funded team very well might attempt it.'
Now for the details that make this unsettling. HAWK had already undergone two rounds of human peer review over two years. The model found the vulnerability in about 60 hours, costing around $100,000 in API fees. The researcher leading the project had a theoretical computer science background and was not a lattice cryptography specialist.
Sophie Schmieg, a post-quantum cryptographer at Google, summarized it in five words: 'Essentially, with this paper, HAWK is dead.' The next day, the HAWK team withdrew the scheme from NIST consideration, noting that obvious fixes like doubling parameters or moving to higher-rank modules would render it uncompetitive against alternatives.
Quantum computers were not involved at any stage. The problem was with post-quantum cryptography, broken over a long weekend by a classic AI model.
What the Survey Really Showed
Each option in our survey asked the same core question: when will the hardware arrive? Readers' opinions on this were roughly evenly split, and the 47% forecast within nine years is quite reasonable given how qubit count estimates have shifted this year.
However, the HAWK research results suggest that hardware development timelines may not be the limiting factor. The 33% who voted for the 'not that soon' or 'only after 2050' options were betting on quantum engineering, and they may very well be right. That bet does not protect them from a classic AI attack on the replacement algorithm.
The 20% who answered 'I have no idea' deserve some credit here. In an audience that follows this closely, one in five declining to guess is not apathy. It is rather an accurate assessment of how many unknown factors are stacking up one after another: hardware progress, algorithm selection, consensus timelines, and now AI-driven cryptanalysis that is evolving faster than the verification process created to detect it.
end-content
