Bitcoin's Q-Day Preparations Already Behind Schedule, Experts Warn

According to Casa's chief security officer Jameson Lopp, a quantum machine capable of breaking Bitcoin (BTC) remains many magnitudes distant. Despite that, he cautions that the work needed for Bitcoin's Q-Day is already behind schedule.

This conflict places approximately 2.6 million BTC—valued at around $207 billion—at the heart of the discussion. These funds reside in addresses that might never transition to quantum-resistant cryptography.

What Is the Real Timeline for Bitcoin's Q-Day?

Casa offers multi-key Bitcoin custody services. During a recent interview, Lopp said that bridging the distance would require multiple significant advances.

Support for his view comes from existing hardware. Google’s Willow chip runs on 105 qubits. In March, the firm estimated that fewer than 500,000 qubits would be needed to crack Bitcoin's signatures.

This represents a disparity exceeding 4,700 times. Still, Lopp offered a caution. Advances in artificial intelligence (AI) often affect other fields, and quantum research might be the next beneficiary.

The danger specifically applies to Bitcoin’s elliptic-curve signatures, not the SHA-256 hashing used in mining. Quantum computers offer much less advantage for mining operations.

Could Bitcoin Face a Quantum Break in Under Ten Years?

Stefano Gogioso, a quantum computing lecturer at Oxford and a member of BeInCrypto’s Future Tech & AI Council, envisions a shorter timeframe. He is also a co-founder of Spooqy, a startup developing quantum money.

Gogioso defines Q-Day as the moment when Bitcoin's secp256k1 curve can be compromised in under a single block, about 10 minutes. According to his team's models, that point arrives in the early to mid 2030s.

Indeed, that's Bitcoin's Q-Day: when we can break secp256k1 in under a block's time.

Our forecasting models set it to the early/mid 2030s based on current technology trends, depending on how conservative we want to be in our estimates.

— Stefano Gogioso (@StefanoGogioso) October 24, 2026

During a July Q-Day expert panel, he maintained that even a low probability of a breach warrants immediate preparation.

What Makes Governance the Key Obstacle?

Lopp sets the deadline in his own words.

“I’m still hopeful that we have at least a decade or more, because if we have less than a decade, we’re behind… as we all know, Bitcoin is very, very difficult to change.”

Casa's chief security officer Jameson Lopp made the comment during a recent interview.

In a September essay, Lopp elaborated on this reasoning. He co-wrote BIP-361, a draft plan to gradually remove quantum-vulnerable signatures over multiple years.

He anticipates no serious push to activate the proposal until a viable quantum computer appears within a decade. Gogioso's prediction sits within that range.

The migration process is inherently slow. According to Lopp's essay, Bitcoin research firm Chaincode Labs reckons a complete upgrade might span five to 15 years.

Gogioso pointed to Bitcoin's absence of formal governance as the reason for the sluggish reaction, as he stated in July.

Which Bitcoin Holdings Are Most at Risk?

The threat does not apply equally to all bitcoin. Coins whose public keys are already visible on the blockchain provide an attacker with unlimited opportunity.

This category includes early pay-to-public-key (P2PK) outputs, reused addresses, and Taproot outputs. Lopp calculates that around 2.6 million BTC, approximately 13% of the total supply, may never undergo migration.

“Bitcoin’s quantum problem is not urgent in the sense that users should panic today. It is urgent in the sense that decentralized systems must solve hard coordination problems before they become emergencies.”

Lopp wrote in his essay.

Major holders are already taking action. Coinbase, which custodies roughly 12% of all BTC, released a post-quantum readiness plan in October. Yet Bitcoin's protocol remains without a consensus timeline.